8

I work on a small network that runs on windows server 2003, and with machines running xp. Is there a group policy that could push a new user name and password to replace our old local administrator user accounts?

1
  • Are you using Active Directory?
    – Sam Cogan
    Jun 10, 2009 at 17:05

4 Answers 4

5

I use pspasswd from sysinternals.

http://www.microsoft.com/technet/sysinternals/Utilities/PsPasswd.mspx

Here is a user automating it:

http://forum.sysinternals.com/forum_posts.asp?TID=9469

Edit:

I also just found this which is exactly what you are asking for:

http://www.gilham.org/Blog/Lists/Posts/Post.aspx?List=aab85845-88d2-4091-8088-a6bbce0a4304&ID=505

4
  • Ick. What about computers that aren't powered on? Jun 10, 2009 at 17:15
  • Check my edit for the GP way to do it.
    – MathewC
    Jun 10, 2009 at 17:51
  • That will work if you have the Group Policy Preferences client rolled-out to your clients, or are using clients that have that functionality built-in. If you've got Windows 2000 or Windows XP w/o the GPP client installed, though, you're out of luck with this method. Jun 10, 2009 at 18:02
  • By default the policy value will be readable by anyone in the domain. The password will be in that file, and while it is encrypted, the key used to encrypt the password has been published.
    – Zoredache
    Feb 14, 2013 at 0:25
2

I use a computer startup script to do this for local "Administrator" passwords, combined with a "trap door" group membership so that the script only runs once.

  • Create a group in the AD - "Local Administrator Password Set". Modify the permissions on the group to allow "Domain Computers" to "Add/Remove Self as Member".

  • Create a new GPO, "Set Local Administrator Password" and link it wherever you want in the directory. Modify the permission on the GPO to DENY "Apply Group Policy" to members of the "Local Administrator Password Set" group. Remove the "Authenticated Users" from the stock permission and add "Domain Computers" with "Read" and "Apply Group Policy" permission.

  • Add a startup script to the GPO with:

    NET USER Administrator new_password_here NET GROUP "Local Administrator Password Set" %COMPUTERNAME%$ /ADD /DOMAIN

  • Link the GPO wherever I want it to apply.

(I really enjoy doing "trapdoor" scripts like this. I use them to run SYSOCMGR the first time a new PC is joined to the domain, etc.)

2
  • 1
    But then the password is in plaintext... Jun 10, 2009 at 17:30
  • Readable by "Domain Computers", yes. Delete the script after it's run everywhere you want it to if you're worried about it. The password has to exist in plaintext somewhere, at least once. Jun 10, 2009 at 17:39
1

Password, no; you can, however, set the Administrator username using GP. It's under:

  • Computer Settings
  • Windows Settings
  • Security Settings
  • Local Policies
  • Security Options

Find the one called "Rename administrator account", and change it to whatever you want.

For re-setting the password, we've simply set them all on installation to ridiculously long strings, then created a "Workstation Admin" group in Active Directory; then, using Group Policy, go to:

  • Computer -> Windows -> Security -> Restricted Groups

Add the new group, and make them a member of "Administrators". So long as your PCs are joined to the domain, and you give your techies membership of this group, they can log on using their personal Active Directory accounts, rather than sharing a local administrator account (which gives you much more accountability!).

Your mileage may vary when using this technique on laptops or machines that are often disconnected from AD, of course.

Hope that helps!

2
  • I think what you are thinking of here is a the domain administrator's username change. I was looking for a group-policy that would push a local administrator and password to replace the original.
    – killamjr
    Jun 13, 2009 at 1:54
  • No, this setting also works for local Administrator account usernames - it applies to all computers affected by the policy. Unless you mean replacing the original administrator's profile with a template..? Jun 15, 2009 at 11:35
0

You can attach a startup script for the computer account. This can check the existence of a user and if it's not there, create it. The catch is ensuring the password is encrypted in some manner. However, it sounds like you just want to rename the administrator account. If so, see Keith's response. You can rename via GPO and that's the way to go. Setting the password is more difficult and can't be done directly via GPO except through a startup script.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .