Solved

Running KeyMgr.dll remotely

Posted on 2012-03-30
6
1,877 Views
Last Modified: 2012-06-27
As many other people have complained, we've had problems with people saving credentials when they connect through a proxy server, and then their accounts get locked out weeks later when they change their password.
We have proven that this problem can be solved by accessing KeyMgr.dll and deleting any of the saved credentials.

We have users who touch literally 100's of computers in a month, and so when their account gets locked out, trying to track down which computers they might have touched, and then log into each individually and clear the credentials by hand is an arduous task.

Question:  Is there a way to do the equivalent of running KeyMgr.dll and deleting ALL saved credentials, but to do this remotely (or even better: via batch) to computers remotely?
0
Comment
Question by:TomPro
  • 2
  • 2
6 Comments
 
LVL 65

Accepted Solution

by:
RobSampson earned 500 total points
Comment Utility
Hi, add this to a logon script:
cmdkey /delete:<proxyserveraddress>

or to remove all saved credentials:
cmdkey /delete:*

This way, when anyone logs on, their credentials will be removed.  If you are not sure whether systems have cmdkey on them, copy it to a network location, and use
\\server\share\cmdkey /delete:<proxyserveraddress>

Regards,

Rob.
0
 
LVL 1

Author Comment

by:TomPro
Comment Utility
I like the solution of using CmdKey and will do some testing.  

Is there a way to run the /list version remotely?  For instance:  Can I create a batch that runs on the AD that would query each of the domain members one by one and return the results of a CmdKey /list for each?
I want to add the script with the delete/*, but I'd like to be able to check all of the systems before I implement the script to make sure that I'm not deleting something that should really still be there, and with some 1000 member servers, it'll take forever for me to log into each one at a time to check their listings.
0
 
LVL 65

Assisted Solution

by:RobSampson
RobSampson earned 500 total points
Comment Utility
Hi, you can, with PSExec, but the output's not too clean.  You'd need to parse it further.  If you copy cmdkey to a network share, you can direct PSExec to run it from there, and then store the cmdkey output in another shared folder:

C:\Tools\psexec -accepteula -u domain\administrator -p password \\REMOTEPC cmd /c \\server\share\cmdkey /list > \\server\share\CmdKey\cmdkeyoutput.txt

Or you could just use this in a logon script
cmdkey /delete:<proxyserveraddress>

so that you only affect the credentials for that one resource.

Regards,

Rob.
0
 
LVL 1

Author Closing Comment

by:TomPro
Comment Utility
RobSampson had it right.  Thanks VERY much for all your help.  I apologize for the delay in closing.
0

Featured Post

How to Backup Ubuntu to Amazon S3

CloudBerry Backup offers automatic cloud backup and restoration for Linux. It has both GUI and command line interface (CLI) ensuring its flexibility in use. Find out more

Join & Write a Comment

The use of stolen credentials is a hot commodity this year allowing threat actors to move laterally within the network in order to avoid breach detection.
Email signature management is something that is often overlooked in many organizations or is simply not implemented effectively. Let's take a look at what methods are available for managing this important piece of corporate branding.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now