1

Anyone know of a quick way to enable to local administrator account and change the password… script, batch file, GPO. Need to do this on about 100 pc’s

8 Spice ups
2

This should do the trick:

http://community.spiceworks.com/scripts/show/60-set-local-administrator-password

3

As I’m only just beginning my career in IT I currently use NT password reset disk which takes 3 minutes. 3 mins x 100 Pc’s = 5 hours down the pan

4

Enable WINDOWS 7 Administrator Account with Group Policy (GPO)

7 Spice ups
5

You should also be able to use the net user command in a batch file/ CMD to enable and set the password. net user

"net user administrator yourpasswordhere /active:yes

the downside to thsi is it would still require an admin to login to each pc

2 Spice ups
6

Microsoft has a tool you can download called psexec that will let you run a command on a remote computer. the net user command can Enable accounts and set passwords.

adminpasswd.ps1 (144 Bytes)

7

RemoteExec will do the job Phillip.

RemoteExec remotely installs applications, executes programs/scripts and updates files and folders on Windows systems throughout the network.

Among other features, RemoteExec allows remotely changing the Local Administrator Password and disabling all other local accounts in order to reinforce security.

You can download a free, fully-functional trial from our website.

When it comes to PsExec, please check this comparative analysis:
RemoteExec vs. PsExec : not is the same league

RELocalAccountMaintenance.gif
RELocalAccountMaintenance.gif823×481 29.1 KB
8

My 2 cents guys…

@Sam6565,

That would be painful process and would be needed if the all of the local administrator account passwords were lost. Otherwise a domain admin account or similar would be able to just reset the password via script, batch file, etc.

psPassword (from the PsTools suite) also works great for changing passwords, but not enabling the account.

@Brian_Noga and others reading…

I don’t suggest using GP Preferences to change the local admin passwords. Reason being, the passwords are encrypted with an 256bit AES key. As AES is a symmetric encryption algorithm, the key to encrypt the passwords is equivalent (=the same) as the key to decrypt it. The second thing is that the XML files the encrypted passwords are stored in are saved on the SYSVOL where all ‘authenticated users’ have read access to. So if I have the key that is used for encrption/decryption, I can get all of your GP Preference pushed passwords.

excerpt from * Florian’s Blog *

Mike

9

Hello Guys,

Above post looks good, but i am still not able to change the password with GPO, i have 300+ computers with XP/7/8 and 10.

The password section is greyed out.

can you please help.

10

If all systems are in domain joined. Then log on to your system with domain admin and run below.

wmic /node:\“remote computer name” useraccount where name=‘administrator’ set disabled=‘false’