Re: Cmd Line adding users, I'm sure it has been asked but....

From: Torgeir Bakken \(MVP\) (Torgeir.Bakken-spam_at_hydro.com)
Date: 01/12/05 

Date: Thu, 13 Jan 2005 00:16:12 +0100

tester wrote:

> I am looking for a quick way to add an account(local admin) to all pc's in
> my IP range. I can run it as the domain admin. I just took over at a new
> office and want to remove the old local accounts.
>
> So I need to go thru all computers (w2k, 2003, xp) servers and workstations,
> and dump the local accounts, their group membership etc to a file, then toss
> them all. But I want to create my own local backdoor admin account just in
> case on all of them.
Hi

Why not just use the builtin Administrator account as the local
backdoor admin account?

Just run a script that sets the builtin administrator account name to
a set name ("Administrator" or something else if you want), and resets
the password as well. This way you will have full control over the name
and password of the builtin Administrator account.

You could do it in a computer startup script (with a GPO) that runs
as part of the boot up process (before the user logs in). It runs
under the system context and has admin rights.

This way the user name/password will be set at every computer startup.

To avoid users being able to read the script where the password is
stored, grant read access only for the AD group "Domain Computers"
to the script file.

This VBScript should do the job:

'--------------------8<----------------------
'
' Description: Script that renames the builtin administrator
' account to the name set in the variable sNewUser, as well
' as setting the password set in the variable sNewPassword
'
' Should also work against a remote domain computer as long
' as user running the script have administrator rights on it.
' (you just need to adjust the sComputerName definition)
'

' new user name to be given if name is not the same already
sNewUser = "Administrator"

' password to be set on the account
sNewPassword = "testpassword"

Set oWshNet = CreateObject("WScript.Network")

' get computer name for local computer
sComputerName = oWshNet.ComputerName
' If you want to run the script against a remote computer,
' disable the line above and enable the line below
'sComputerName = "SomeComputer"

' obtain current administrator name regardless of name
sOldUser = GetAdministratorName(sComputerName)

' Turn off internal error handling
On Error Resume Next

' connect to user object
Set oUser = GetObject("WinNT://" & sComputerName & "/" _
                & sOldUser & ",user")

oUser.SetPassword sNewPassword
oUser.SetInfo

If sNewUser <> sOldUser Then
   Set oComputer = GetObject("WinNT://" & sComputerName)

   ' rename user
   Set oNewUser = oComputer.MoveHere(oUser.ADsPath, sNewUser)
End If

On Error Goto 0

Function GetAdministratorName(sComputerName)
   Dim sUserSID, oWshNetwork, oUserAccount

   Set oUserAccounts = GetObject( _
        "winmgmts:{impersonationLevel=impersonate}!//" _
      & sComputerName & "/root/cimv2").ExecQuery( _
        "Select Name, SID from Win32_UserAccount WHERE Domain = '" _
      & sComputerName & "'")

   On Error Resume Next
   For Each oUserAccount In oUserAccounts
     If Left(oUserAccount.SID, 9) = "S-1-5-21-" And _
        Right(oUserAccount.SID, 4) = "-500" Then
       GetAdministratorName = oUserAccount.Name
       Exit For
     End if
   Next
End Function

'--------------------8<---------------------- 

-- 
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.mspx

Relevant Pages

  • Re: Keep admins off of client machines
    ... the sharepoint admin is simple, just create a standard user account for them ... The 'Domain Administrator' account is ... Domain Administrator password. ... takes a thorough understanding of such priveleges to do so. ...
    (microsoft.public.windows.server.sbs)
  • Re: firewall on budget ?
    ... 1)Work in Admin mode, and through 'run as', browse ... If working in admin mode and doing runas to browse in a guest account. ... Installing a program, getting an error, then doing the run as, can be ... running as administrator all the time. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: XP (SP2) user passwords
    ... Safe Mode requires an administrator to log on the machine. ... I always suggest checking who has Admin accounts, ... administrator account, which normally does not appear, and in SP2, I don't ...
    (microsoft.public.windows.mediacenter)
  • Re: Could this be an XP problem?
    ... >> This means you have admin access under jlunis login. ... This is one way to get in as admin in XP home. ... >> tab) then type in administrator as username and blank password. ... administrator account. ...
    (microsoft.public.windowsxp.general)
  • Re: Keep admins off of client machines
    ... The 'Domain Administrator' account is ... > administration person from the domain admin account is complex and fraught ... > change the Domain Administrator password. ... > it takes a thorough understanding of such priveleges to do so. ...
    (microsoft.public.windows.server.sbs)
Loading