1

I have deployed an Active Directory in a small company. Each and every user is trusted with local admin privileges on his computer with his domain account.

However, in case the users can't log on to their computer, I need to have local Admin accounts enabled and with a password. Trouble is, because password change via GPOs has been removed I can't use it to change admin password.

This removal is due to a security flaw, which is irrelevant because users are local admins.

What I need is an easy way to activate and change builtin admin accounts' password, via GPO, without the trouble of a two-pages long script (I know there's one). The password should be the same for everyone and never change.

1
  • Microsoft only removed the functionality from the user interface - clients will still take the password change, you just have to manually enter the password in the policy object's XML file. Jul 9, 2016 at 16:05

3 Answers 3

1

Add this a logon script select Powershell, remember administrator account remains disabled we need to active it added at last line of script.

$computer=$env:computername
$user = "administrator"
$Password = "password"
$user = [adsi]"WinNT://$computer/$user,user"
$user.SetPassword($Password)
net user administrator /active:yes
1
  • 2
    Since startup scripts are stored in \\domaincontroller\sysvol\domainname\Policies\{PolicyGUID}\User\Scripts` and %systemroot%\system32\grouppolicy` on the local machine, you might want to save the password as a secure string. I know I'm one to talk since mine had that cleartext as well, but it wasn't stored on shares or the actual workstations. Jul 9, 2016 at 14:01
7

you could replace that with LAPS

1
  • 1
    LAPS doesn't meet the requirements, but is a better solution. Having the same admin password across the org means if any computer is compromised, they all can be. Also keep in mind Windows caches ad password, so even if the domain controller is inaccessible, so long as a user has logged in recently they will still be able to.
    – Eric
    Jul 9, 2016 at 17:34
2

If you're willing to use a script rather than group policy, it shouldn't take two pages. Since I have scripts lying around anyway for a different purpose that could be altered, I'd probably do something like:

Get a list of computers (will probably need tweaking for your environment, both for the OU and for the limit):

dsquery computer ou=sbscomputers,ou=computers,ou=mybusiness,dc=mydomain,dc=local -o rdn -limit 500  > control.txt

SetLocal EnableDelayedExpansion

FOR /F %%L IN (control.txt) DO (
    set line=%%L
    echo !line!
    set line=!line:"=!
    echo !line!
    echo !line! >> process.txt
)

sort < process.txt > sorted.txt

del process.txt
move sorted.txt control.txt

You can then do something like:

$computers = Get-Content -Path c:\path\to\control.txt
$user = "administrator"
$Password = "password"
Foreach($computer in $computers) {
    $user = [adsi]"WinNT://$computer/$user,user"
    $user.SetPassword($Password)
    $user.SetInfo()
    echo "Password reset on $computer"
}

It would be better still to save the password as a secure string. This article has useful instructions for that. If you don't, you probably want to edit the password out of the second script after running it.

1
  • Your second example does not work with multiple PCs because you are changing the user variable inside the loop. Once you change one of them it does work correctly.
    – Brian D.
    Aug 23, 2018 at 17:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .