Improve company productivity with a Business Account.Sign Up

x
?
Solved

GPO for administrator account

Posted on 2014-04-21
7
Medium Priority
?
306 Views
Last Modified: 2014-06-12
Looking to create a vb script that will enable the built in administrator account (if disabled)
Rename it too – Admin
And set a password
(Windows 7)
Would like to do this via GPO, is there a vb script option to run at startup?

Thanks
0
Comment
Question by:kwatt562
  • 3
  • 2
  • 2
7 Comments
 
LVL 22

Expert Comment

by:Joseph Moody
ID: 40012441
This can be done in Group Policy.

The enable and rename settings can be found under Computer Configuration/Window Settings/Security Settings/Local Policies/Security Options/Accounts.

You can set the password with Group Policy Preferences Local Users and Groups.
0
 

Author Comment

by:kwatt562
ID: 40012492
The first part is OK, not sure how to set the password though as its 2003 server
0
 
LVL 22

Accepted Solution

by:
Joseph Moody earned 2000 total points
ID: 40012522
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 

Author Comment

by:kwatt562
ID: 40012540
Cancel that I have found a 2008 R2 server :) will let you know how goes, thanks  alot
0
 
LVL 59

Expert Comment

by:McKnife
ID: 40013702
It should be noted that using group policy preferences to set the password puts the whole lot of computers at risk because
A that password is the same everywhere
B it can be read out in plain text, so anyone with a little knowhow could own all your computers from now on if he liked to.
Read results here: https://www.google.com/search?q=gpp+password+security&sourceid=ie7&rls=com.microsoft:en-US:IE-Address&ie=&oe=
Please note that the link you were given contained that warning, too (at the very end).*

You should tell us why you need that account and what you use it for. Maybe we can tell you a better solution to achieve it.

*Just for laughs: the MVP (F. Frommherz) who in that linked article claimed we could not get our hands on a plaintext password changed his mind: http://www.frickelsoft.net/blog/?p=116

http://www.gruppenrichtlinien.de/artikel/verwaltungaenderung-der-lokalen-administratoren-kennworte/ is another tactical approach: set the pw, apply and delete the GPO afterwards so that it cannot be attacked in sysvol. Ha... that's history. Win8.1 uses GPO caching, it will have a local copy of that policy, so we have to be careful! Read http://4sysops.com/archives/group-policy-caching-in-windows-8-1/
0
 
LVL 59

Expert Comment

by:McKnife
ID: 40129873
The solution is no solution, sorry. Simply, because it does not work anymore. Since the patch day of may 14, for security's sake, microsoft has disabled the ability to enclose passwords in account items in group policy preferences.
0
 
LVL 59

Expert Comment

by:McKnife
ID: 40129921
So better look at the alternative described here: http://blogs.technet.com/b/askpfeplat/archive/2014/05/19/how-to-automate-changing-the-local-administrator-password.aspx - it holds all the background info to the change as well.
0

Featured Post

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

A bad practice commonly found during an account life cycle is to set its password to an initial, insecure password. The Password Reset Tool was developed to make the password reset process easier and more secure.
High user turnover can cause old/redundant user data to consume valuable space. UserResourceCleanup was developed to address this by automatically deleting user folders when the user account is deleted.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

585 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question