The Pspasswd tool, which is part of the Sysinternals PsTools download, can be used to reset the local administrator password across one or more machines locally or remotely.
The tool must be run while logged on with an account that has administrative rights on the target computer, for example a domain admin account. You can also specify those credentials via the command-line. Pspasswd uses Windows authentication methods to authenticate to remote systems and does not put passwords in clear text over the network.
For a single computer:
pspasswd \\computer_name Local_administrator_account_name “New_Password”
For multiple computers:
pspasswd \\computer1_name,computer2_name,computer3_name Local_administrator_account_name “New_Password”
For all computers in the environment:
pspasswd \\* Local_administrator_account_name “New_Password”
For multiple computers using a text file containing the computer names:
pspasswd \\@file.txt Local_administrator_account_name “New_Password”
DEMO: How it Works on Windows 7 - in Video (Portuguese Brazil)
Ed Price MSFT edited Revision 2. Comment: Tags
Take a look at the feature offered in SYNERGIX AD Client Extensions
http://www.synergix.com This link is external to TechNet Wiki. It will open in a new window.
The built-in administrator account password management has following options
- System generated passwords with min 8 characters
- Password changed frequently ( every 7 days )
- Unique password across domain computers
- Password validation ( every day )
- No backend SQL , IIS server required.
- Manage backup administrator account, account name can be system generated
- No scripting required
- Only designated administrators can retrieve built-in administrator account password
Found one link ...
support.synergix.com/.../23775318-Test-Scenario-Managing-Built-In-Administrator-Account-Password This link is external to TechNet Wiki. It will open in a new window.
Still on a Server 2003 domain I have no GPP option.
Took me a bit to get the syntax correct. Got mine to work like this:
C:\1\pstools>pspasswd.exe @computers2.txt administrator 123xyz
Worked on my Windows 7 machines too.
It opened a command window, I watched as it hit each machine, watched success & failures.
Just to clarify the Sysinternal Tools attempt to use your current user profiles credentials to authenticate against the other Machines / Domain. If you are running as an admin you are fine.
If however you are using a limited account when you open the tool you will need to specify a username and a password using the "-u" and "-p" switches. Using these DOES transmit your username and password in plain text.
So I guess the simple answer is, if in your IT Department you all run as standard users elevating only when necessary I would do a runas before running the program.
Is this really needed in an AD environment anymore? Couldn't you just use Group Policy Preferences to set local account passwords? (Full Disclosure: I'm also guilty of writing scripts that used pstools to set/reset passwords)
If you are worried about a password being sent in clear text on your own network....then you have bigger problems.
The PsPasswd download page has been updated to indicate that it does not send passwords in the clear.
technet.microsoft.com/.../bb897543.aspx
Unfortunately I don't know how pspasswd works. But I know that psexec (a tool from the same toolkit) sends all its communications (including passwords!) in clear text over the network. So if pspasswd works in a similar way it might be inappropriate from security perspective. There’s no good in bulk changing passwords to something everybody could sniff!
(BTW could anybody tell me how the password is transferred in case I change it using lusrmgr.msc connected remotely?)
My tool of choice is passgen from “Protect Your Windows Network” by Steve Riley & Jesper Johannson. The tool is still available freely on Steve's current blog at http://stvrly.wordpress.com/. One very important feature I use extensively is ability to set random (or semi-random) passwords. In this case we don’t need to transfer the password over the network and worry about encrypting it. We could just send the utility itself and execute it locally with appropriate commands (using something like WinRM, PSExec, Task Scheduler, startup scripts or anything else like System Center ConfigMgr).