Changing local accounts on multiple machines in a domain.

[immorall]

I was wondering if anyone knew of a way to change the local admin account on multiple machines in a domain instead of having to go to every account to change it manually. Whether there was some way through group policy or a script of some sort? Anything would be helpful.

Thanks

[allen2]

Yes there is a very simple way if all your computers are in the same domain and reboot some times:

Create a gpo with a startup script .cmd (computer, windows parameters,scripts):

the script will be like this:

net user administrator password

Replace password with the password you want.

[Ctrl-X]

Don't use a CMD file; a smart user will be able to find it in the SYSVOL share and read the password. Run NET.EXE with the appropriate parameters straight from the GPO startup script instead. Probably not completely secure either, but at least it's harder to find.

[InTheWayBoy]

Hell, if you wanna do it even further, get something like AutoIt. Simple script to make the password change:

RunWait(net user administrator password)

That's probably not 100% correct mind you.

Then you could run it through this:

http://www.autoitscript.com/forum/index.php?showtopic=32171

Which should scramble a some of the code...since this is so simple it might not do much. But after that is run compile the script to an .exe (A standard feature of AutoIt) and run that through a GPO. I would imagine you could enlist NTFS permissions to lock down the file on the server.

Of course it's still got problems, but its not a bad idea when you think about it. Good luck!