Re: File Encryption

What I am trying to do is, We have roughly 1000 computers that we?d like to
change the local admin passwords on. I have a VB script that I can
implement that works perfectly to change the password. I do not want this
script sent along as clear text if I can avoid it. Is there any way I can
encrypt this script?

SET objComputer = GetObject("WinNT://W2Kmachine,computer")
SET objAccount = objComputer.GetObject("user", "Administrator")
objAccount.SetPassword "password"
objAccount.SetInfo


I know I can protect the files using Windows permissions (preventing anyone
from reading the script) or allowing only Domain Computers Read Only access?
However. How can I protect the script. If you could capture the packets,
you could easily find the script and its contents so permissions would not
matter at all in that scenario.

Maybe there is some other solutions for this? Any help and/or insight is
greatly appreciated.

StefStephens

"Marin Marinov" <marin-online@xxxxxxxxxx> wrote in message
news:MPG.1dfa84c6fd48116598990f@xxxxxxxxxxxxxxxxxxxxxxx
> In article <#wBsoi39FHA.140@xxxxxxxxxxxxxxxxxxxx>, "Milan Stojanovic"
> <username piksi@host eunet dot not com but YU> says...
>>
>> Sorry for interrupting, but I think that it is a great idea to have
>> report
>> of all workstations with some encrypted file. Do I need to modify MOF and
>> use a script, or it can be made by default mof?
>>
>> thanks in advance...
> <snip>
> Hi Milan,
> I would argue that it's such a good idea and this goes back to my
> initial question - why would one need that ;) Technically speaking,
> there are ways you could potentially do it:
> - script that recurses through all files and folders and reports data
> either in WMI or dumps a NOIDMIF file
> - figuring out how to make software inventory report IsEncrypted for a
> file. Software inventory seems to store file inventory information in
> the FileSystemFile WMI class (http://tinyurl.com/bgvqy) under root\ccm
> \invagt. However, the XML file that it generates and passes on to the MP
> (http://tinyurl.com/dk8ko) doesn't seem to contain all the properties
> available in this class.
> - for folders only, making use of the Win32_Directory class and its
> Encrypted property
>
> Bare in mind though that most of these (probably except option 2) will
> likely result in a performance hit on the respective computers. And
> again - finding out which machines have encrypted files is arguably
> beneficial plus it's reactive, not proactive. As a best practice, if
> your organization hasn't deployed a "real" PKI, deployed and maintains
> certificates for the users for use with EFS, disable EFS on the clients.
> If people can encrypt files whenever they chose without this being an
> officially designed for and supported feature, this can cause you a lot
> of headaches...pardon, "administrative overhead" ;)
>
> HTH
> --
> Cheers,
> Marin Marinov
> MCT,MCSE,MCSE:Security,MCP+I
> -
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
> "True knowledge exists in knowing that you know nothing."
> Socrates


.

Relevant Pages

  • Re: Finding users in local admin groups
    ... > Here is a vbscript that you can run against a remote computer that moves ... > *local* users except 'Administrator) from the Administrators group to the ... You should also add to the script logging to a file of the ... > you moved on what computers. ...
    (microsoft.public.win2000.security)
  • Re: Change local administrator password ? through GPO or push script ?
    ... I would like to change the local administrator password of every computers member of my AD domain but I am not sure of the best method. ... Create a vbs script that points to the local computer and then deploy this script by GPO. ... This attribute will permit to know wich admin password is configured for this machine. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Not so Newbie
    ... The script is designed for situations like yours. ... wit 35+ computers and to go to each of those computers to individualy ... Prompt for an executable to run on each remote computer in the group. ... so you know where the deployment failed. ...
    (microsoft.public.windows.server.scripting)
  • Re: VBscript that restart the domain comptuer
    ... If you have a shutdown script that cleans up the profiles, ... permissions can restart all computers in a list remotely. ... I have already VB script I ...
    (microsoft.public.windows.server.active_directory)
  • Re: Sending computer name to txt file if file didnt copy?
    ... look intot he MSI etc suggestion. ... 150 computers and dont have access to AD to do it that way. ... Const OverwriteExisting = True ... This modified version of your script will inform you if there ...
    (microsoft.public.scripting.vbscript)