Software

Ask something
Question Locked

apply local admin password over 1500 machine using GP

0 helpful
11 replies

by yasser.fouad

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Dears,

could any one help me in solving this issue?

i want to deploy a local administrator password over 1500 machine located at different OU's representing each computer's department,

i created a batch file containg the command to change the admin password per machine per departement, but i need to deploy these scripts on the machines startup using GP rather than manualy running the script on every machine,

i have been told that this may make a security vulnerability that users may know the path to the SysVol shared folder and can see the applied password on all departments as long as they have a NTFS read permission for the policy to be applied,

so please correct me if this is wrong

and if it is correct, could you help me in the deployement task without any security threats
My goal is: change local admin pass per different OU, minimize security risks stated before

i got some ideas from which, is to encrypt the passwords, but i need your assistance in guiding me how to apply

your fast response is highly appreciated,

thanks in advance

BR,
Yasser

11 replies

by bincarnato

Put this at the begining of you batch file and it should prevent EUs from seeing your batch file as it runs.

by yasser.fouad

thanks for your fast reply, but i didn't mean to hide the batch file when it runs, i want to encrypt the contents of the batch file,

any help?

by cmiller5400

using a .vbe file to do a wshShell.Run " change password command here" and then encoding it with screnc.exe available on the Microsoft site. That encrypts the command so it is not visible to the end users and can not be displayed. The output is a .vbe file. Input is .vbs.

by ic-it

write the simple script with the password change. Then use the tool Aut2Exe (same site) to turn the script into an executable. That way the password is not exposed.
Here is a link to the site and downloads.

http://www.autoitscript.com/autoit3/

by yasser.fouad

thanks for replying,

but i couldn't understand what you are pointing to,

and after encrypting the file contents, and applying the group policy, will it decrypt the file contents before deploying to the PCs

by cmiller5400

Create a file called Pwdchange.vbs
In this file put the command
Set WshShell = WScript.CreateObject("WScript.Shell")

wshShell.Run "change password command here"

The "change password command here" is the section where you run the executable such as "Net User administrator thepassword"
Save the file
download the screnc.exe file from Microsoft
encrypt the file using screnc. This will change the file from a .vbs to a .vbe It will not be readable by any users, but will run fine.

by yasser.fouad

dear bro,
thank you so much, it worked well

and if you coan help me in the following, i'll be grateful

i need to create a vbscript that do the following:

1- The VB script can obtain the computer name, localy or remotely, and set it as a string variable

2- the obtained string will be the input of function that will obtain the below mentioned formula based on the obtained computer name

the function may do the following:

if i have a string contains a mix of numbers and letters, i.e 09AD7786L, i need to generate the below

L@da68*36

where L is the last letter of the main text, @ is appended text, da is the reverse of 3rd and 4th letters but in lower case, * is appended text, 68 is the reverse of the 86 sequence in the original text, the 36 is the sum of all numbers in the original text

3- the string resulted after applying the formula, would be the local administrator password for that machine

waiting your feed back

by yasser.fouad

thank you so, i yhoght of this, i.e to change the scrip to exe file, and run it on the startup of the machines, but for the autoit tool, it uses only a .au file while my script is on a simple text file converted to a MS-DOS batch, and it canot run it, i tried to use the tool editor with no help, can you help me in guiding me how to use it??

by cmiller5400

Something along this
[b]
Set WshNetwork = Wscript.CreateObject ("WScript.Network")
set oShell = WScript.CreateObject("WScript.Shell")

strComputer = WshNetwork.ComputerName

password = ""

password = Right(strComputer,1) & "@" & lCase(Mid(strComputer,4,1)) & lCase(Mid(strComputer,3,1)) & _
mid(strcomputer,(Len(strcomputer)-1),1) & mid(strcomputer,(Len(strcomputer)-2),1) & "*"

intSum = 0
i = 0

for i = 0 to (len (strcomputer))
testNum = Mid(strcomputer,(i+1),1)
if IsNumeric(testnum) then
intsum = intsum + testnum
end if
next

password = password & intSum

passcmd = "net user test " & password

oShell.Run passcmd

[/b]

by cmiller5400

Since the site is acting up so much, I could not edit my post, but I was able to post a new one so here it goes.

Please test this code several times to make sure that it works as you intended. I have fixed a minor issue in the display of the code so that you can copy/paste it into a file.

[b]
Set WshNetwork = Wscript.CreateObject ("WScript.Network")
set oShell = WScript.CreateObject("WScript.Shell")

strComputer = WshNetwork.ComputerName

password = ""

password = Right(strComputer,1) & "@" & lCase(Mid(strComputer,4,1)) & _ lCase(Mid(strComputer,3,1)) & _
mid(strcomputer,(Len(strcomputer)-1),1) & _ mid(strcomputer,(Len(strcomputer)-2),1) & "*"

intSum = 0
i = 0

for i = 0 to (len (strcomputer))
testNum = Mid(strcomputer,(i+1),1)
if IsNumeric(testnum) then
intsum = intsum + testnum
end if
next

password = password & intSum

passcmd = "net user test " & password

oShell.Run passcmd
[/b]

This discussion is closed to new replies.