Although there appears to be three available options, one of which is actually secure, there seems to be only two available choices that will be able to impact machines that are not powered on at the time of change or are mobile and were not on the network at time of change. Neither of the two appear to be a secure option. The three options that I'm aware of are:
- Startup scripts with .vbs
- GPO using Group Policy Preferences
- Powershell script as a scheduled task.
I dismiss the Powershell option because I don't know how to effectively target/iterate, and dismiss machines already changed, all the machines on the network and what impact that would have on unnecessary network overhead, even though it is probably the best available solution since the password itself can be stored in a CipherSafe.NET (3rd party solution) container and the password passed to the script to the targeted machine. I haven't checked to see if Powershell can get a password from the Credential Manager of a local Windows machine to use in the script or if it is possible to store a password there for use with the script either.
The .vbs script option is insecure because the password is stored in clear text in the SYSVOL share which is available to any domain machine on the network. Anyone that is looking to find a back door and with a bit of Google will find that door if persistent enough.
The GPO option is also insecure as noted by this MSDN note: http://code.msdn.microsoft.com/Solution-for-management-of-ae44e789
I'm searching for a non-3rd party solution which I think should be available or able to be developed in house with the right knowledge or guidance.