Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I work on a small network that runs on windows server 2003, and with machines running xp. Is there a group policy that could push a new user name and password to replace our old local administrator user accounts?

share|improve this question
    
Are you using Active Directory? –  Sam Jun 10 '09 at 17:05

4 Answers 4

up vote 5 down vote accepted

I use pspasswd from sysinternals.

http://www.microsoft.com/technet/sysinternals/Utilities/PsPasswd.mspx

Here is a user automating it:

http://forum.sysinternals.com/forum_posts.asp?TID=9469

Edit:

I also just found this which is exactly what you are asking for:

http://www.gilham.org/Blog/Lists/Posts/Post.aspx?List=aab85845-88d2-4091-8088-a6bbce0a4304&ID=505

share|improve this answer
    
Ick. What about computers that aren't powered on? –  Evan Anderson Jun 10 '09 at 17:15
    
Check my edit for the GP way to do it. –  MathewC Jun 10 '09 at 17:51
    
That will work if you have the Group Policy Preferences client rolled-out to your clients, or are using clients that have that functionality built-in. If you've got Windows 2000 or Windows XP w/o the GPP client installed, though, you're out of luck with this method. –  Evan Anderson Jun 10 '09 at 18:02
    
By default the policy value will be readable by anyone in the domain. The password will be in that file, and while it is encrypted, the key used to encrypt the password has been published. –  Zoredache Feb 14 '13 at 0:25

I use a computer startup script to do this for local "Administrator" passwords, combined with a "trap door" group membership so that the script only runs once.

  • Create a group in the AD - "Local Administrator Password Set". Modify the permissions on the group to allow "Domain Computers" to "Add/Remove Self as Member".

  • Create a new GPO, "Set Local Administrator Password" and link it wherever you want in the directory. Modify the permission on the GPO to DENY "Apply Group Policy" to members of the "Local Administrator Password Set" group. Remove the "Authenticated Users" from the stock permission and add "Domain Computers" with "Read" and "Apply Group Policy" permission.

  • Add a startup script to the GPO with:

    NET USER Administrator new_password_here NET GROUP "Local Administrator Password Set" %COMPUTERNAME%$ /ADD /DOMAIN

  • Link the GPO wherever I want it to apply.

(I really enjoy doing "trapdoor" scripts like this. I use them to run SYSOCMGR the first time a new PC is joined to the domain, etc.)

share|improve this answer
1  
But then the password is in plaintext... –  K. Brian Kelley Jun 10 '09 at 17:30
    
Readable by "Domain Computers", yes. Delete the script after it's run everywhere you want it to if you're worried about it. The password has to exist in plaintext somewhere, at least once. –  Evan Anderson Jun 10 '09 at 17:39

You can attach a startup script for the computer account. This can check the existence of a user and if it's not there, create it. The catch is ensuring the password is encrypted in some manner. However, it sounds like you just want to rename the administrator account. If so, see Keith's response. You can rename via GPO and that's the way to go. Setting the password is more difficult and can't be done directly via GPO except through a startup script.

share|improve this answer

Password, no; you can, however, set the Administrator username using GP. It's under:

  • Computer Settings
  • Windows Settings
  • Security Settings
  • Local Policies
  • Security Options

Find the one called "Rename administrator account", and change it to whatever you want.

For re-setting the password, we've simply set them all on installation to ridiculously long strings, then created a "Workstation Admin" group in Active Directory; then, using Group Policy, go to:

  • Computer -> Windows -> Security -> Restricted Groups

Add the new group, and make them a member of "Administrators". So long as your PCs are joined to the domain, and you give your techies membership of this group, they can log on using their personal Active Directory accounts, rather than sharing a local administrator account (which gives you much more accountability!).

Your mileage may vary when using this technique on laptops or machines that are often disconnected from AD, of course.

Hope that helps!

share|improve this answer
    
I think what you are thinking of here is a the domain administrator's username change. I was looking for a group-policy that would push a local administrator and password to replace the original. –  killamjr Jun 13 '09 at 1:54
    
No, this setting also works for local Administrator account usernames - it applies to all computers affected by the policy. Unless you mean replacing the original administrator's profile with a template..? –  Keith Williams Jun 15 '09 at 11:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.