4

x3 Server 2012 R2, x2 Server 2012

My system has 5 servers; 1 Hyper-V server hosting 2 vm servers (these are the x3 2012 R2 servers), and a Win 8.1 pc running hyper-V that hosts 2 more vm servers (these vm's are the x2 2012 servers).

Every 45 days the servers warn to change the passwords. Is this a manual process only on each server, or is there some shortcut/batch that would allow changing the password on all servers at the same time?

2 Answers 2

3

You could also use PsPasswd from the SysInternals suite. PsTools tend to have a few dependencies (like maybe a default share or something) but they're usually pretty stable. It's worth noting it does send passwords in the clear. I don't know if the other solution does too.

3
  • I have a very private network, so passwords in the clear is not an issue. I just want a way to reset everything at the same time. I use the same password everywhere for simplicity. Obviously with a bigger system and more users I'll have to change that, but for now your solution is pretty much what I was hoping existed. Thanks! (BTW, typo in your answer? should "nothing" be "noting"?)
    – Alan
    Jun 28, 2015 at 21:36
  • @Alan Glad I could help! Typo fixed, it's definitely not nothing :) Jul 1, 2015 at 4:33
  • @Alan also I'm not sure how tangential we can get on here since I'm new (my guess is not very) but if you're fuzzy on what account is forcing a change every 45 days and assuming you're confused on whether it's domain or local, the difference would be in whether it's enforced your local security policy or group policy. If it's local, it's a local user. Assuming you're joined to a domain, you can see local policy by running net accounts in Command Prompt. You can see domain by running net accounts /domain Jul 1, 2015 at 4:37
8

If the servers are on the domain.

Local Administrator Password Solution

Microsoft is offering the Local Administrator Password Solution (LAPS) that provides a solution to the issue of using a common local account with an identical password on every computer in a domain. LAPS resolves this issue by setting a different, random password for the common local administrator account on every computer in the domain. Domain administrators using the solution can determine which users, such as helpdesk administrators, are authorized to read passwords.

https://technet.microsoft.com/en-us/library/security/3062591.aspx

3
  • Cool! Just to make sure I understood correctly, LAPS will reset every server's password automatically according to the rules, and store it in AD, where an authorized user could then obtain the password for a given server. But please confirm, each server's password will be random and unique.
    – Alan
    Jun 23, 2015 at 23:24
  • 1
    To be clear Alan, this is relevant to the local Administrator user account. This is not the server (computer account) password.
    – joeqwerty
    Jun 24, 2015 at 0:09
  • @joeqwerty. Good insight into the problem I'm having relative to these passwords. The LAPS solution above is pretty cool, but not actually the answer I was looking for. While I haven't executed it yet, Michael's answer below was what I hoped was available. I'm struggling a little with the password issue; I don't think I'm grasping what I'm being asked to change every 45 days; I need to pay closer attention to the account requesting a new password. So far I haven't 'blown anything up', but I don't think I have a handle on it.
    – Alan
    Jun 28, 2015 at 21:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .