The company I work for has a lot of engineers employed. It seems some of them have nothing else to do but check out the latest on the Netlogon shares, as soon as they detect a change in the logon script, or in how their computer reacts to certain commands etc.

Some time ago, we had to use the local administrator password in a script. We made it as difficult as (then) possible for the users to find it, even put in in unreadable form, but a couple of days later, one of the (honest) technical users gave us a call, and told us the password. After this, we made a 180 degrees turn, and we will never put anything like that in any script again, unless we're absolutely sure that users are unable to find it. (read it/crack it). We have learned our lesson.

To still perform a similar function, we made a .BAT file containing a command with the password needed for this command. (say for example, a NET USE command, providing username and password). What we did, was convert the BAT file to EXE, and encrypt this EXE to a new EXE using a password and an encrypting util. This file cannot be read as easily.

Of course; all passwords can be cracked, but if they can crack this file within reasonable time, they will be employed by IT. (haha!). I've unleached crack programs on this file, but the time they would need to crack it, is very satisfactory !! (More than a year). Since the passwords for these functions are changed more often, this is an unlikely event.

What I'm looking for, is a way to prevent that users can read scripts that easily, thus preventing that when we write a script, for example disabling the File and Printer sharing button, they won't create a regpatch enabeling it again for themselves. Even if the encryption is simple, and the client decrypts the file, the users most likely won't go through the trouble of trying..
Even if they do, we still won't place password or thing like that in there, so...