Script to Change Local Administrator Password

Hi!

Here is my task. I need a logon script that will change the password of the local administrator on each machine in my domain.

I have been searching for a while and have come up with a 2 script solution for my problem, but it seems that there has to be a way to do this with one script.

So far i have a script that uses the runas command to run another script that actually does the password change. This is to make sure that the script can run with enough rights to make the change.

Is there a way to do this with a single script and have the necessary rights to make the password change?

Here are my 2 scripts that I run so far:

************************************************
Dim WshShell, FSO

sUser = "username@domain.net"
sPass = "password~"

sCommand = "wscript \\server\share\changepassword.vbs"

Set WshShell = CreateObject("WScript.Shell")
Set WshEnv = WshShell.Environment("Process")
WinPath = WshEnv("SystemRoot")&"\System32\runas.exe"
Set FSO = CreateObject("Scripting.FileSystemObject")

rc = WshShell.Run ("runas /noprofile /user:" & sUser & " " & Chr(34) & sCommand & Chr(34))

WScript.Sleep 600

WshShell.AppActivate(WinPath)

WshShell.SendKeys sPass

WScript.quit
**********************************

Here is the changepassword.vbs script that the above script uses:

**********************************
Set WshNetwork = WScript.CreateObject("WScript.Network")
strComputer = WshNetwork.ComputerName

strComputer = "."
Set objUser = GetObject("WinNT://" & strComputer & "/Administrator,user")


objUser.SetPassword "new.password.goes.here" ' <--- this will be the new admin password.
objUser.SetInfo

*************************************

Any ideas would be greatly appreciated.

Do you have active directory? If so, why not do this via policy?

Yes we are running AD.

When you say via policy are you referring to a GPO?

I have gpo's that add certain groups to the local admin group on each pc, but am not aware of a setting that will change the local user "administrator"'s password. If there is a setting for that I will use it, but i haven't found one, yet.

Thanks!

I ran changepassword.vbs logged on as a regular domain user and it worked. Im very interested in this script. I can definitely use something like this. However, I would like to add this to the begining. I just dont know how yet.

Const ForReading = 1
Set objDictionary = CreateObject("Scripting.Dictionary")
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTextFile = objFSO.OpenTextFile _
("c:\workstations.txt", ForReading)
i = 0
Do Until objTextFile.AtEndOfStream
strNextLine = objTextFile.Readline
objDictionary.Add i, strNextLine
i = i + 1
Loop
For Each objItem in objDictionary
StrComputer = objDictionary.Item(objItem)
Set WshNetwork = WScript.CreateObject("WScript.Network")
strComputer = WshNetwork.ComputerName

strComputer = "."
Set objUser = GetObject("WinNT://" & strComputer & "/Administrator,user")


objUser.SetPassword "new.password.goes.here" ' <--- this will be the new admin password.
objUser.SetInfo
Next
Next

Workstations.txt simply contains a list of workstations on each line. The script reads a line from the text file and then runs the password change on all machines in the text file.

Any help with this will be greatly appreciated.

Where do you intend to the change local admin password from ? (eg: startup script or remotely from a central location)

I want to do it remotely, dont know how Caer wants to go about it.

Try the following. Note that you will need admin priv. on all remote machines that you intend to connect to.

Option Explicit

Dim fso, user, ts, temp, src
Set fSO = CreateObject("Scripting.FileSystemObject")
src = "c:\workstations.txt"

If Not fso.FileExists(src) Then
WScript.Echo "File: " & src & " cannot be found."
WScript.Quit
End If

Set ts = fso.OpenTextFile(src,1)
Do Until ts.AtEndOfStream
temp = ts.ReadLine
Set user = GetObject("WinNT://" & temp & "/Administrator,user")
user.setpassword "new_password"
user.setinfo
Loop

thank you Token, the script works great. Good work friend :)

No problem :D

For my purposes I am using one script as a logon script with the changepassword.vbs sitting on a network share. Was just wishing that there was a way to make the change to a local admin password without having to use 2 scripts. But at least it does work ;)

Now im adding some error handling to the script, as well as having it report the computer name, date, time, and logged on user when the script is run. I will post it later for all to critique.

><,
Caer

If you run the script from a startup script, you shouldn't need to worry about persmissions and you can mostly use one script instead.

So when i create a gpo to run the script use a computer startup script instead of a user logon script?

That would really simplify things.

Thanks for all your help so far!

Caer

Well, you got me curious and i found this:

http://www.microsoft.com/technet/prodtechnol/windows2000serv/maintain/optimize/startw2k.mspx

Using the computer startup script will work fine for changing the password.

So now i could either use the changepassword.vbs as the startup script. I would use a vbs script instead of the "Net user Administrator %1" command suggested by url above because it will contain a cleartext password, with vbs i can encode that information since it will be residing on a netlogon share with read rights for everyone.


Thanks Again!

Caer ><

Here is something you can try. Because it use computername$ account, you can easily grant read permission to a list of computers within an OU without granting domain users read permission.

You should also note that encoded script can easily be decoded :)

http://www.spoogenet.com/index.php?module=article&view=13&5cbaa9d36385e275f0a415eb9b827618=ce3490f9c7f17afbe1e8e3405431fcc8

Thanks!

FYI the reason I was wanting to use a startup or logon script is because the domain im on is on a global scale from Germany, USA, Canada, and Mexico. For me to ensure that all of the remote users, folks with laptops, etc.. get the script ('cause they all log on at way different times) i have to have it run as a startup/logon script.

Ok. Here is what i finally ended up with for my scripts.

LocalAdminPasswordChange.vbs
******************************

'==========================================================================
'
' VBScript Source File -- Created with SAPIEN Technologies PrimalScript 3.1
'
' NAME: Local Admin Password Change
'
' AUTHOR: PutYourNameHERE!!!!
' DATE : 4/22/2005
'
' COMMENT: This script is designed to be used as a login script
' that will change the Password of the Local Administrator
' on the computer that it is run on using creditials from a
' specified user account and password.
' NOTE: It calls the ChangePassword.vbs from a specified path in this
' script. If the ChangePassword.vbs file is not in the path, Then
' the script will not change the local admin password.
'==========================================================================
'==========================================================================
'********** IMPORTANT INFORMATION **********************
'* Because .vbs files are easy to view and this one contains a clear text
'* password it is important to use the Microsoft Script encoder to keep
'* sensitive information unavailable to someone using a text editor.
'* The encoder can be found at:
'* http://msdn.microsoft.com/library/default.asp?url=/downloads/list/webdev.asp
'* It is a command line tool FYI.
'==========================================================================

' ** First we set the variables for the script ** '
Dim WshShell, objFSO

' ** sUser is the Username
' ** sPass is the Users password
' ** sCommand is the command that you want run
' **
' ** You can replace these string variables to any user/password/command
' ** combo that you need to run on a pc.
' ** NOTE: If you change the sPass field be sure to retain the
' ** quotes and the ~ at the end of the actual password, it
' ** is the carriage return character.
sUser = "username@domain.net"
sPass = "userpassword~"

' ** USAGE: sCommand = "wscript <path_to_scripts>\<your_script_here.vbs"
' ** or you can write in any command that needs to be run under
' ** a specific users account.
sCommand = "wscript \\Servername\Sharename\changepassword.vbs"

' ** This is where we setup the working environment for the script to run in.
Set objComputer = CreateObject("Shell.LocalMachine")
Set WshNetwork = CreateObject("WScript.Network")
Set WshShell = CreateObject("WScript.Shell")
Set WshEnv = WshShell.Environment("Process")
WinPath = WshEnv("SystemRoot")&"\System32\runas.exe"
Set objFSO = CreateObject("Scripting.FileSystemObject")

'** Here we will check to see if this script has run on this computer.
'** If the file exist then we will end the script.

If objFSO.FileExists("C:\ScriptLog.txt") Then
WScript.Quit

Else
' ** Here we open the Finished.txt and append the name of the computer
' ** that was just changed and the date it happened.

Set objTextFile = objFSO.OpenTextFile("\\Servername\Sharename\Finished.txt", 8, True)
objTextFile.WriteLine(objComputer.MachineName) & " " & Date() & " " & Time() & " " & (WshNetwork.UserName)
objTextFile.Close

' ** Here we write a .txt file to the root of c: for verification that the script
' ** has been run on this computer.

Set objFile = objFSO.CreateTextFile("C:\ScriptLog.txt")

End If

' ** This is the meat of the program and where the actual command is run.
rc = WshShell.Run ("runas /noprofile /user:" & sUser & " " & Chr(34) & sCommand & Chr(34))

' ** This gives the command window the time to open.
WScript.Sleep 900

' ** This will grab the active command window to send the password to.
WshShell.AppActivate(WinPath)

' ** This will send the password to the waiting window.
WshShell.SendKeys sPass

WScript.quit

*********************************************


Changepassword.vbs


*********************************************

'==========================================================================
'
' VBScript Source File -- Created with SAPIEN Technologies PrimalScript 3.1
'
' NAME: Change Password
'
' AUTHOR: PutYourNameHERE!!!!
' DATE : 4/22/2005
'
' COMMENT: This script is designed to work in conjuntion with
' the LocalAdminPasswordChange.vbs script as it must
' be run with administrative priviledges for the script
' to function properly.
'==========================================================================

'==========================================================================
'********** IMPORTANT INFORMATION **********************
'* Because .vbs files are easy to view and this one contains a clear text
'* password it is important to use the Microsoft Script encoder to keep
'* sensitive information unavailable to someone using a text editor.
'* The encoder can be found at:
'* http://msdn.microsoft.com/library/default.asp?url=/downloads/list/webdev.asp
'* It is a command line tool FYI.
'==========================================================================

' ** Setup the variables and working environment for the script **

Set WshNetwork = WScript.CreateObject("WScript.Network")
strComputer = WshNetwork.ComputerName

'* This gets the name of the current computer and then
'* retrieves the \\<computername>\Administrator account
'* as the object that we want to work with.

strComputer = "."
Set objUser = GetObject("WinNT://" & strComputer & "/Administrator,user")


' ******* This sets the Administrator Password here **************************
' ** NOTE: Type in quotes what you would like the new
' ** Local Administrator Account password to be set
' ** to, but keep in mind password complexity restrictions
' ** for your login server.

objUser.SetPassword "new.password.goes.here" ' <--- this will be the new admin password.
objUser.SetInfo

**********************************************************


You guys are great! Thanks again!

Caer ><

Hi guys, I?m trying to change a local administrator account password for machines that are under WXP and W2K pro. Under Windows XP, the script executed succesfully but it didn?t do anything under W2K pro.

The VBS script was applied through a GPO in the Computer startup scripts. Here it goes:

logon.vbs

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Usuario="platcserv"

Set objUser = GetObject("WinNT://" & strComputer & "/" & Usuario & ", user")

'objUser.SetPassword "09iuy%4e"
objUser.SetPassword "1234567890"

objUser.SetInfo

Also, I created a GPO and linked it to an OU called "Machines A" where the 2 differents OS machines are.

I don?t understand why this script is not working in the machines under W2K pro.


What can I do in order to have the script working on both OS?. I appreciate any help.

Thanks a lot!!
Joseph Garcia

Hey Token,

You gave me this script here not too long ago. The problem I'm having is the script stops running if one of the machines in the text file cant be reached. Anyway to prevent this?

Option Explicit

Dim fso, user, ts, temp, src
Set fSO = CreateObject("Scripting.FileSystemObject")
src = "c:\workstations.txt"

If Not fso.FileExists(src) Then
WScript.Echo "File: " & src & " cannot be found."
WScript.Quit
End If

Set ts = fso.OpenTextFile(src,1)
Do Until ts.AtEndOfStream
temp = ts.ReadLine
Set user = GetObject("WinNT://" & temp & "/Administrator,user")
user.setpassword "new_password"
user.setinfo
Loop


Thank again,
Coquito

I know this thread is ancient but I got a follow up question...
In our domain there is alot of different languages and therefore the local administrator account have different names.
Is there some other way to get the administrator account?

Loop through the administrators group perhaps?

Set objGroup = GetObject("WinNT://" & strComputer & "/Administrators,group")

For Each objMember In objGroup.Members
    Wscript.Echo objMember.Name
Next