Change local administrator password ? through GPO or push script ?

[Imthyaz K]

I’m running an AD Domain with about 60 users. Due to some reason I wanted to change their computers local Administrator passwords. I know couple of ways but I don’t know which will be much better for the same. The first way I was thing is creating a VBS Script that points to the local computer (".") and then deploy this script by GPO. But the problem in this is password is not encrypted at all.

And the second method I was planning was to execute a script which will scan all computers accounts on the domain and then "push" the new password to them. But the problem in this is what if the computer is not connected to the domain? Obviously its password will remain the same old one.

So can anyone please provide me any better workaround here? Many thanks.

[Hanson]

Dont get surprised after reading this post Imtiyaz. I know you are in problem and dont want to go with any of your two methods. But i'm in a very similar problem and i'll be happy to test out your both methods. So can you please provide me your script about which you were talking above?

Thank you.

[Amadeus]

There is a file named 'cusermgr.exe' in your resource kit. I think it will help you to change the passwords for all your domain computers. Infact it is the best solution for your second method without any requirement of scripting for the change (just iterating computer accounts). Also i found an article which may help you for your 1st method as well. Just have a look at this KB Article:
http://www.microsoft.com/technet/pro.../startw2k.mspx

As your problem was password encryption, this will help you out.

[techman]

I'm not sure but you should give this a try. It may help you out for sure.

Create a batch file pass.bat (or whatever) with the content
"net user administrator %1". Here %1 describes the first entry in the parameter field.

OR

net user %1 %2 (you also can use %1 %2 and add "Username Password" in the parameter field). Once done, just add this file into Default domain policy>Computer configuration>Windows settings>Scripts using GPO. STARTUP script and set the parameter with the new parameters you like to use.