What is the best way to securely change the local administrator password in a domain?

What is the best way to securely change the local administrator password in a domain?

What's the most secure way to go about changing the local administrator password on 300 computers in a domain?

    Requires Free Membership to View

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

Changing local administrator passwords is a good security practice to keep intruders from getting into workstations and wreaking havoc.

But, keep this in mind if you still want control over the computers on the domain level or through Active Directory. Make sure to first add your domain administrators group to the local administrator group on the computer before you apply the changes on the workstations. Otherwise, you won't be able to remotely administer the machines through the domain.

There are two automated approaches to changing local administrator accounts and passwords on multiple computers in a domain. One is to write a batch script and, the other, if the machines are running Windows, is to use a tool from Microsoft.

The preferred way is to use the Microsoft tool cusrmgr.exe, which comes as part of the Windows 2000 Resource Kit, but can be used on other Windows versions as well. This is done by using cusrmgr.exe to run a batch script that cycles through the workstations on the domain.

To briefly highlight the script method to present an idea of what's possible, scripts in VBScript and Windows Script Host are available on the Web for searching and updating workstations in an Active Directory domain. A 25-line script can usually do the trick.

For more information:

  • In this tip, Joel Dubin offers best practices and tools for ensuring password compliance.
  • Learn how to securely distribute one-time password tokens.
  • This was first published in November 2007

    Join the conversationComment

    Share
    Comments

      Results

      Contribute to the conversation

      All fields are required. Comments will appear at the bottom of the article.