Thanks Robdutoit. No issues with privileges, since the script will be running under the "System" account.

 Originally Posted By: Glenn Barnas
Dataspike,

If you're using GPO to run this script to set the local admin password on the workstations, why not just use a GPO to set the workstation's local admin password directly?

If you can't use policy for whatever reason, the Secure Admin Install Suite can do this for you without exposing any credentials.. look in the Script Vault here on KORG.

Another option is to encrypt the password in an external file, and decrypt it in the script, which is tokenized. The CYPHER() UDF can be found here on KORG and downloaded from my web site from that page. It's pre-tokenized to insure the security, so needs to be loaded into your scripts via a CALL statement. It's a cross between the WW-II Germam Inigma code, updated from 8 to 2048 codewheels, and a code used by an episode of Mission: Impossible in 1968. The cool thing about this is you can't crack the code based on character frequency - with the right key, something like "cat" can be written as "GGG".

Glenn

Hi Glenn.

Thanks for the response.

Using GPO to set password isn't very secure, the password is stored inside the GPO folder on your DC and is using an encrypted format that is well known and easy to crack. In addition, it doesn't work as well as expected. I tried.

Sorry, the "Secure Admin Install Suite", hadn't heard about it. I took a quick look and while this would work for some situations, I don't think it'll fit for my needs, as the sample code above is just a portion of my overall script which I intend on using as a startup script. Since it's running as a startup script, it has the appropriate credentials, so I don't have an elevation issue.

The encrypt option is more my thought for this. The tokenized process is what is escaping me at the moment. I'm not really sure how this whole process works. I really hate to ask, but based on my example above, would you be able to give me an example of how to tokenize?

 Originally Posted By: Glenn Barnas
 Code:
Shell 'net.exe user ' + $sAdmin + ' Password'
is the clue.. This syntax of the NET command sets the password for a local user.. you can run NET USER /? on your PC for full info.

Glenn

Sorry, not sure who this portion was directed to? If me, then yup. I know all these. I grew up on DOS and related commands. The big part I'm missing or don't know is the tokenized functions; how to do, use, read, etc.