Question

vbs coding help to change domain user password when offsite

Asked by: Bowen1973

Hi,

i have been working on a script to change a domain users password when they are offsite, then restart the comp if that user is logged in...

i.e.... script is ran, downloads user list off the net, if users is on laptop it renames password, if user is logged in it restarts laptop..

it all works apart from the password...

i have tried:

strComputer = "."
strSetPassword = "password" 'change this to required password
Set objUser = GetObject("WinNT://" & strComputer & strNextLine)
objUser.SetPassword(strSetPassword)

and also :

strSetPassword = "password" 'change this to required password
Set objUser = GetObject("LDAP://cn="& strNextLine",dc=ourdomain,dc=com")
objUser.SetPassword(strSetPassword)

but neither seem to be working... any help please??

'*************************************************************************
'** Script By Mark Bowen 02.09.09                                       **
'**                                                                     **
'** run script to change users password.                                **
'** Username picked up from users.txt file                              **
'** after changing password the computer forces a restart if the target **
'** user is loggedin reboot so user cannot login                        **
'**                                                                     **
'*************************************************************************
 
'this part downloads the file to the stated directory
 
Dim oShel
Const adTypeBinary = 1
Const adSaveCreateNotExist = 1
Const adSaveCreateOverWrite = 2
set oXMLHTTP = WScript.CreateObject("Microsoft.XMLHTTP")
oXMLHTTP.open "GET", "http://www.targetwebsite.uk/user.txt", False
oXMLHTTP.send
set oStream = createobject("adodb.stream")
oStream.type = adTypeBinary
oStream.open
oStream.write oXMLHTTP.responseBody
oStream.savetofile "c:\user.txt", adSaveCreateOverWrite
set oStream = nothing
set oHTTP = nothing
 
' this part reads the downloaded file
 
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.GetFile("c:\user.txt")
If objFile.Size > 0 Then
    Set objReadFile = objFSO.OpenTextFile("c:\user.txt", 1)
    strContents = objReadFile.ReadAll
    'Wscript.Echo strContents
    objReadFile.Close
Else
'Wscript.Echo "The file is empty."
End If
Const ForReading = 1
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTextFile = objFSO.OpenTextFile _
    ("c:\user.txt", ForReading)
Do Until objTextFile.AtEndOfStream
    strNextLine = objTextFile.Readline    
on error resume next
 
'this part renames the password for the user(S) in the file
 
strComputer = "."
strSetPassword = "password" 'change this to required password
'Set objUser = GetObject("WinNT://" & strComputer & strNextLine)
Set objUser = GetObject("LDAP://cn="& strNextLine",dc=ourdomain,dc=com")
objUser.SetPassword(strSetPassword)
 
'this restarts the pc if the user is logged in
 
Set oShell = CreateObject("WScript.Shell")
Set WshNetwork = WScript.CreateObject("WScript.Network")
'WScript.Echo "User Name = " & WshNetwork.UserName
if WshNetwork.UserName = strNextLine then
strComputer = "localhost"
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Shutdown)}!\\" & _
strComputer & "\root\cimv2")
Set colOperatingSystems = objWMIService.ExecQuery _
("Select * from Win32_OperatingSystem")
For Each objOperatingSystem in colOperatingSystems
objOperatingSystem.Reboot()
Next
else 
'wscript.Echo "restart not required"
end if
loop

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:

Select all Open in new window

This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Plus...

30 Day FREE access, no risk, no obligation
Collaborate with the world's top tech experts
Unlimited access to our exclusive solution database
Never be left without tech help again

Subscribe Now

Asked On: 2009-09-08 at 03:33:52ID24714342
Tags: vbs
,; domain user
,; password
,; script
Topic: VB Script
Participating Experts: 1
Points: 500
Comments: 9

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

"The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
"Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
"Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Free Tech Articles

WARNING: 5 Reasons why you should NEVER fix a computer for free.
It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
SCCM OSD Basic troubleshooting
SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
Create a Win7 Gadget
This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
Outlook continually prompting for username and password
There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
Backup Exchange 2010 Information Store using Windows Backup
There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

Avoiding Bugs in Microsoft Access
Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
Top 10 Best New Features in Visio 2010
Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
IT Consultant Business Secrets Revealed
Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
Disaster Recovery and Business Continuity
Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
Organize Your Visio Diagrams with Containers and Lists
Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
How to Us Objects, Properties, Events and Methods in Microsoft Access
Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Watch More

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

by: jimbobmcgeePosted on 2009-09-08 at 03:38:57ID: 25280366

I've not had to do this for a while but I think you need a call to objUser.SetInfo before the password will save...

http://www.computerperformance.co.uk/vbscript/vbscript_setpassword.htm

by: Bowen1973Posted on 2009-09-08 at 04:12:55ID: 25280573

hi,

thanks for the input,

i have added the objUser.SetInfo after objUser.SetPassword(strSetPassword) and still no joy i'm afraid and i am able to log in using the normal password..

not sure if i have the ldap part right... i hope this will change the password when the user is offsite and wont have access to our servers if using the Ldap route.

thanks - mark

by: jimbobmcgeePosted on 2009-09-08 at 07:54:31ID: 25282499

Hmmm. Semantically, I'm not sure you can do what you are asking. You wish to change a domain account's password when the laptop is taken off-site (i.e. can no longer access the domain).

I don't think you will be able to do this. When you do not have access to the domain, the laptop will use cached credentials to log the user on. This means it will store the last few username/password combinations as one-way hashes, which it will use to compare against what you type into the login fields.

If there is no access to the domain, the domain password cannot be saved. I'm not sure what happens when you change the password manually in this situation.

If you are just trying to prevent a user from logging onto the machine when offsite, an alternative may be to clear out the cached credentials. You could perform your check for domain accessibility as you currently are then, if they cannot access the domain, set the necessary Registry value so that the computer does not save cached credentials.

The Registry key for this is:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\cachedlogonscount

but, as far as I know, it is only checked when the computer starts, so there would be that first period where the user could log in but, after that, they could only use local accounts.

Note that this behaviour directly negates the point of cached credentials (i.e. to allow your laptop-owning users to access their computers when they are offsite). This might lead to an increase in support calls for you when the MD can't check his email from home.

J.

by: Bowen1973Posted on 2009-09-08 at 08:36:18ID: 25282970

hi, thanks for the info....i'll give it a bask and see if i can work it into the VB script.

the reason for the password change is that we have reps/agents and when they leave us we find it difficult to retrieve the laptops from them (one excuse after another). esp if they go and work for a competitor.

the idea is that i update a list on the web of 'disabled' users... the scripts runs (i havent figured out how yet ( either by IE start or the laptop seeing and internet connection)) then the script downloads the hit list renames the password and if that user is logged in it restarts the laptop effectively locking them out so they no longer have access to company emails/sales database/customers etc... that way our info is safe until we get our hardware back.

how would i get a vb script to clear the registry value so they cannot login?

thanks - Mark

by: jimbobmcgeePosted on 2009-09-08 at 08:56:24ID: 25283210

This sounds like a user-management issue to me, rather than a script one. Can the users currently access your network remotely (e.g. via VPN)? If so, you should make sure that all of their user accounts (VPN, AD, POP3, SMTP, external servers, etc) are disabled when they are let go.

Your script will have to be much further-reaching than simply clearing the cached credentials. You'd probably need to start with silently clearing their Documents and Settings folder (which should take care of things like cached email and network settings); and changing passwords for and locking local user accounts (in case they have created a back-door account). Then you could clear cached credentials for good measure and finally display a message telling them to mail the laptop back to you at the following address or face legal action.

Firstly, though, you will have to be absolutely certain that the destruction should take place. I wouldn't want to be in your shoes if you run a script like this based on whether they can access the domain because it only takes one DC outage and all your users will brick their machines. Personally, I would go for a blacklist file served by a public web server, that the script downloads and parses.

You're not going to stop a determined user logging onto their stolen laptop and accessing their stolen data. And you can't be sure that you get all the files, unless you know where that particular user stores their files.

To answer your query regarding writing to the Registry, try the attached.

J.

Dim shell : Set shell = CreateObject("WScript.Shell")
Shell.RegWrite "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\cachedlogonscount", 0, "REG_DWORD"

1:
2:

Select all Open in new window

by: Bowen1973Posted on 2009-09-08 at 09:36:19ID: 25283606

hi,

the script is ran by a txt file on our site. or moreso, when the script runs it downloads a file from our site then executes the password change & restart if the user is logged in and is listed in the file. with the user not seeing our domain or have access to our network via vpn i couldnt use the ldap route. so needed another way.

once i stop them from login in they cant have access via any backdoors as they only have limited access locked by GPO, and only i have the local admin access too.

i'll add the registry part to the script and will let you know how i get on....i will prob have to allow general users access to the registry first otherwise the script wont change the registry as they wont have the rights to do it.

thanks - mark

by: jimbobmcgeePosted on 2009-09-08 at 09:49:01ID: 25283733

I believe, if your script is added to the Computer Startup Scripts part of a GPO (rather than User Login Scripts), it runs with administrative privileges, so you should not need you to give additional permissions.

>> only i have the local admin access too
http://home.eunet.no/pnordahl/ntpasswd/ might disagree with you. Like I said, any determined user is going to get in...

by: Bowen1973Posted on 2009-09-09 at 06:53:40ID: 25291279

hi,

luckily our reps aint that clever to do that...lol.... but someone they know might be....

i have tried running your registry part in the script and it keeps letting me log in as the test user after the machine restarts....

any ideas?

thanks - mark

by: jimbobmcgeePosted on 2009-09-09 at 08:17:50ID: 25292170

What is your test process? I see it as:

- connect laptop to LAN with domain access
- start laptop
- login as test domain user
- note value of "cachedlogonscount" in registry
- logoff, shutdown
- disconnect from LAN (and turn off WLAN)
- start laptop
- login as test domain user (using cached credentials)
- confirm script has run; note value of "cachedlogonscount" in registry
- logoff, reboot
- login as test domain user

Also, http://www.experts-exchange.com/articles/OS/Microsoft_Operating_Systems/How-to-DELETE-Windows-Local-Domain-Cached-Credentials.html has some interesting ideas.

You could possibly use WMI to enumerate all the values in HKLM\SECURITY\Cache then, if it ends with a number, you could set its value to 0.

An example of enumerating registry values with WMI can be found at http://msdn.microsoft.com/en-us/library/aa390388(VS.85).aspx and one for writing those values can be found at http://msdn.microsoft.com/en-us/library/aa393286(VS.85).aspx.

Not sure how you would do this as the SYSTEM user, unless I am right about the Computer Startup Scripts section of Group Policy. That said, I was able to view and edit these using my own user account...

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

For individual users
Instant access to solutions
Ask your tech questions
Start your 30-day Free Trial

Business Accounts

Perfect for organizations
Multiple users
Save over 36%
Create a Business Account

Answer for Membership

Earn free access
Showcase your knowledge
No credit card required
Sign Up to Answer

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...

Question

vbs coding help to change domain user password when offsite

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

vbs

domain user

password

script

VB Script

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press