Admin changes

Last week, during our Infrastructure IT Audit, we decided that we need to change the local admin accounts on all the pc's on the company's domain. I looked around for the simplest way to achieve this. There are many forums explaining the procedure, therefore I thought of summing it all up and put it all in one simple way.

There are couple of ways we can perform this operation: -

1. WUS.

2. By installing GP CSE (client side extension) and XML Lite on every pc.

3. WMI scripts OR

4. Using the pspasswd command from pstools.

Out of the all above the best is the WUS way. However, we do not yet have this implemented therefore the second option was to install the CSE and XML Lite for running a centralised script on the network. This seems a good choice however this also needs visiting all the pc’s. The GP Client Policy is coming as an update from MS now, so you could install this patch next time on the pc visit?

OR

The simplest way to do the above is using the pstools. I have tested it now and it is working quite well without the users realising and it also uses Windows password reset APIs, so does not send passwords over the network in the clear.

This could also be done in batch for more than one or all computers through file list.

Here is what you need to script (make sure you are logged in as an admin on network) : -

usage: pspasswd [[\\computer[,computer[,..] | @file [-u user [-p psswd]]] Username [NewPassword]

Therefore go to the command prompt (I personally use Powershell on PC's) and type the following (if you are changing the local admin password for one PC): -

cd PsTools

.\pspasswd.exe \\computername localadminusername localadminnewpassword

Aaabra ka Daabra, thats done for you. You will be displayed with the following msg: -

Sysinternals - www.sysinternals.com

Password for computername\localadminusername successfulyl changed.