3

I've got a GPO that is configured to change the local builtin Administrator's password on certain machines. I need to find what machines have applied this GPO to themselves. I've written a script that tries the password on several systems and some have that password and some dont. I've got a lot of machines to go through and attempting the password on all of them wont work for my boss.

Is there a way, given only access to the \DC1\SYSVOL\domain.com\Policies... files that I can determine:

  1. What exactly is the local username that the policy was applied to?
  2. What machine contains this local user?

If I cant determine that just with the SYSVOL share access, what level of access would I need to be able to get the required info?

My boss is breathing down my neck for this and I feel its out of my league.

Thanks for any input or help you can provide-

Improve this question

2 Answers 2

Reset to default
3

You would have to comb the event logs of every machine to see if it has or has not applied the Group Policy. Clients don't notify domain controllers as to whether they have or have not applied a GPO.

In the Group Policy Operational event log on the client, there will be an event ID 5312 that contains a list of all applicable GPOs that are about to be applied to the computer at that time. Your special GPO should be on that list. That event shows up every time a Group Policy refresh happens.

If you want to find GPOs that have local account information in them, do a search for Groups.xml files in your policies. Like this:

$GroupsFiles = Get-ChildItem -Path "\\$Env:UserDNSDomain\SYSVOL" -Recurse -Include Groups.xml

Also, you should stop doing this. Storing local admin passwords in a GPO is EXTREMELY dangerous. They are stored with reversible encryption.

Improve this answer
5
  • What is the "better" way to enforce the local administrator password?
    – fukawi2
    Oct 30, 2013 at 22:45
  • Use a tool like Configuration Manager that is capable of running scripts on each machine individually. Even better would be to use a massively expensive tool such as Cyber-Ark to manage the local passwords on every machine. Even better would be to just disable the local admin account.
    – Ryan Ries
    Oct 30, 2013 at 22:48
  • Thats actually why I need to find the machines, because i need to fix the damage of that GPO fro ma previous admin.
    – user488244
    Oct 30, 2013 at 23:51
  • I have access to that xml file, can it help me out more? Is there anyway to at least correlate the uid field in that xml with an actual local user on the systems?
    – user488244
    Oct 30, 2013 at 23:53
  • @user488244 Not sure what you're talking about. The local admin account always has a sid that ends in -500.
    – Ryan Ries
    Oct 31, 2013 at 1:09
0

Maybe I'm not understanding the question but you can run gpresult against a remote computer and save the results to a file. This will show you what GPO's were applied, when GP was last processed by the computer and will show you what settings were applied by said GPO's.

Improve this answer
1
  • Obviously this was my first thought too... but I'm thinking that we what will ultimately need to do is assume that the computer is in the correct scope for the GPO, but troubleshoot why it still isn't applying. Not sure. If all he had to do was gpresult, I'm gonna be pissed. :P
    – Ryan Ries
    Oct 31, 2013 at 0:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .