Custom Local Administrator Password

One of the challenges that we have in our organization is dealing with local administrator passwords. Through the years, we have used various models for our local admin password to various affect. One of the biggest issues we have run across, though, is that typically we have had one password applied across all of our workstations in our enterprise. We all know that is bad, but finding an alternative can be difficult. At one point, we ran a script that would generate a unique password for the local admin account. Unfortunately, this password had to be written to a single file and was a pain to use as it used any keyboard characters (determining what some of those characters were was difficult).

Over the years, I have also read various advice. Jesper Johansson (a now former MS employee) recommends disabling the local administrator account (http://technet.microsoft.com/en-us/magazine/2006.01.securitywatch.aspx ). His theory is that if you get to a point where everything is broken and you need the local admin account, rebuild the machine. It sounds OK in theory, but I don’t know that we are willing to take that step. Perhaps if we had our SCCM environment all setup so that reimaging a workstation was easy and we knew that all important local data was backed up, it might be a different story.

Instead, we have opted for a different method. We are running a script against workstations to give each workstation a unique custom local admin password. (Our service desk techs all have their own workstation admin account giving them local admin rights on workstations with a named account.) In this posting, I will set out the method that we use to generate this unique custom password.

First, let me make a note of what I mean when I say unique custom password. We use a tool from Jesper Johansson called passgen. We can then feed into this tool “seeds”. In this case, one of the seeds is the workstation name and the second is a passphrase. The tool then takes these two parts and creates a unique password. (In our case, we have also set the length of the password and limited it to using alpha characters, capital and lowercase, and numbers.) Because this tool generates the password based upon known input, we can easily recreate what the local admin password is on a given machine. (Note that less than a handful of people know what the passphrase seed is, so we use scripts for the techs to run if they need to find the local admin password. In fact, we have this script integrated into a custom Active Directory Users and Computers mmc snap-in that we publish for each tech. They are able to click on the workstation name and it will give them an option to generate the local admin password.) Here is the passgen command we run passgen -g ComputerName Phrase -l 10 -e 2 -c 500 –h.

One of the other features we wanted to include in the script is the ability to change the custom password if we needed to give it out to the end user. We have done this by using group membership. Initially, all workstations are not in a group. Because of this, the script sets variables for what the passgen command will be. If we need to iterate the password to the next level, we can add the workstation to a group named WKS_Local Administrator Password x (where x is a number 1-9). This changes the workstation name in the passgen command to have an _X (again where X is the matching number 1-9). Doing this creates an entirely new unique password for that workstation using the new seed. (For example, a workstation may generate the following password when in none of the groups: YOJ9N0NWvZ . When we add it to group 1 (and so the workstation name becomes WKS12345_1 , the new generated password becomes 26lcaK9DWO .) This gives us the ability to iterate the password up to 10 times for each workstation.

I also have the script set so that it will only run once. It does this by creating a file on the local machine. If that file exists, it does not run. I primarily do this for performance reasons, but want to do some further testing to see if this is necessary. I actually think it would be better to continuously run this script at every startup so that if it gets changed, we are changing it back to what it should be. (Eventually, if I do continue to set it to run only once, I would prefer to use a registry key to do so. I am still working on learning the best and most reliable method for that.)

So, now let’s get to the point and show you the script.

'========================================================================== 
' 
' NAME: ChangePasswordLocalAdmin.vbs 
' 
'VERSION:  1.2.0 
'MODIFIED:  Doug Neely 
'DATE:  02/27/09 
'       This will change the password of the local admin account so that every 
'        computer is different, but can be easily retrieved using passgen. 
' 
'Ideally, I am wanting this to be able to check group membership.  This will 
'    be an easy way for us to increment the password changes using groups. 
'    Group membership will change the variables of the computer name. 
'This starts by going through and checking if C:\CONTOSO exists.  If not, it 
'    creates it.  Next, it looks to see if the strSuccess exists.  If it does, 
'    it ends.  If it doesn't, it runs the passgen command.  If it is successful, 
'    it creates a success file and if it fails it creates a failure file. 
' 
'MODIFIED:  Doug Neely 
'DATE:       06/08/09 
'            Revised this script to use a different method for checking group 
'            membership.  This method will place all groups into a dictionary 
'            item for later checking.  It can handle nested groups, primary group 
'            and cross-domain group membership.  This has been pulled from 
'            Robert Mueller's site at http://www.rlmueller.net/IsMember6.htm 
' 
'Additional Notes: 
'passgen -g strComputer strPhrase -l 10 -e 2 -c 500 -h 
'    -g generates a password using the computer name and phrase as a seed 
'    -l 10 - length of 10 characters 
'    -e 2 - limits the password characters to upper case, lower case and numbers 
'    -c 500 - changes the password of the "500" account - administrator 
'    -h  - output is hidden 
'========================================================================== 
Option Explicit 
' Declare objects and variables with global scope. 
Dim objGroupList, adoCommand, adoConnection, objRootDSE 
Dim adoRecordset, strAttributes, strFilter, strQuery 
Dim oADSysInfo, objFSO, objShell, strCONTOSO 
Dim sComputerName, strpassgen, strPhrase, strKeyPath, strValueName, strValue 
Dim    strComputerPath, objComputer, strGroup, shellcmd, strSuccess, sCMD, ND, objFile 
'========================================================================== 
'On Error Resume Next 
Set oADSysInfo     = CreateObject("ADSystemInfo") 
Set objFSO = CreateObject ("Scripting.FileSystemObject") 
Set objShell = CreateObject("WScript.Shell") 
'========================================================================== 
'Configuration Block 
strCONTOSO = "c:\CONTOSO\" 
sComputerName     = GetComputerName 
strpassgen="\\contoso.com\netlogon\passgen.exe" 
strPhrase="HereIsWhereYouWouldPlaceYourUniquePassPhrase!" 
'========================================================================== 
  
strComputerPath = "LDAP://" & oADSysInfo.ComputerName 
Set objComputer = GetObject(strComputerPath) 
  
'Here this looks for group membership. 
  
strGroup = "WKS_Local Administrator Password 1" 
If (IsMember(objComputer, strGroup) = True) Then 
        shellcmd="\\contoso.com\netlogon\passgen -g " & sComputerName & "_1 " & strPhrase & " -l 10 -e 2 -c 500 -h" 
        strValue = "1" 
        strSuccess="C:\CONTOSO\ads1.admp" 
    Else 
  
End If 
  
strGroup = "WKS_Local Administrator Password 2" 
If (IsMember(objComputer, strGroup) = True) Then 
        shellcmd="\\contoso.com\netlogon\passgen -g " & sComputerName & "_2 " & strPhrase & " -l 10 -e 2 -c 500 -h" 
        strValue = "2" 
        strSuccess="C:\CONTOSO\ads2.admp" 
    Else 
  
End If 
  
strGroup = "WKS_Local Administrator Password 3" 
If (IsMember(objComputer, strGroup) = True) Then 
        shellcmd="\\contoso.com\netlogon\passgen -g " & sComputerName & "_3 " & strPhrase & " -l 10 -e 2 -c 500 -h" 
        strValue = "3" 
        strSuccess="C:\CONTOSO\ads3.admp" 
    Else 
  
End If 
  
strGroup = "WKS_Local Administrator Password 4" 
If (IsMember(objComputer, strGroup) = True) Then 
        shellcmd="\\contoso.com\netlogon\passgen -g " & sComputerName & "_4 " & strPhrase & " -l 10 -e 2 -c 500 -h" 
        strValue = "4" 
        strSuccess="C:\CONTOSO\ads4.admp" 
    Else 
  
End If 
  
strGroup = "WKS_Local Administrator Password 5" 
If (IsMember(objComputer, strGroup) = True) Then 
        shellcmd="\\contoso.com\netlogon\passgen -g " & sComputerName & "_5 " & strPhrase & " -l 10 -e 2 -c 500 -h" 
        strValue = "5" 
        strSuccess="C:\CONTOSO\ads5.admp" 
    Else 
  
End If 
  
strGroup = "WKS_Local Administrator Password 6" 
If (IsMember(objComputer, strGroup) = True) Then 
        shellcmd="\\contoso.com\netlogon\passgen -g " & sComputerName & "_6 " & strPhrase & " -l 10 -e 2 -c 500 -h" 
        strValue = "6" 
        strSuccess="C:\CONTOSO\ads6.admp" 
    Else 
  
End If 
  
strGroup = "WKS_Local Administrator Password 7" 
If (IsMember(objComputer, strGroup) = True) Then 
        shellcmd="\\contoso.com\netlogon\passgen -g " & sComputerName & "_7 " & strPhrase & " -l 10 -e 2 -c 500 -h" 
        strValue = "7" 
        strSuccess="C:\CONTOSO\ads7.admp" 
    Else 
  
End If 
  
strGroup = "WKS_Local Administrator Password 8" 
If (IsMember(objComputer, strGroup) = True) Then 
        shellcmd="\\contoso.com\netlogon\passgen -g " & sComputerName & "_8 " & strPhrase & " -l 10 -e 2 -c 500 -h" 
        strValue = "8" 
        strSuccess="C:\CONTOSO\ads8.admp" 
    Else 
  
End If 
  
strGroup = "WKS_Local Administrator Password 9" 
If (IsMember(objComputer, strGroup) = True) Then 
        shellcmd="\\contoso.com\netlogon\passgen -g " & sComputerName & "_9 " & strPhrase & " -l 10 -e 2 -c 500 -h" 
        strValue = "9" 
        strSuccess="C:\CONTOSO\ads9.admp" 
    Else 
  
End If 
  
    If shellcmd = "" Then 
        shellcmd="\\contoso.com\netlogon\passgen -g " & sComputerName & " " & strPhrase & " -l 10 -e 2 -c 500 -h" 
        strValue = "0" 
        strSuccess="C:\CONTOSO\ads.admp" 
        Else 
    End If 
  
If NOT objFSO.FileExists(strSuccess) Then 
    'Deletes any previous success/failure files 
    Set objShell = CreateObject("WScript.Shell") 
    sCMD = "%COMSPEC% /c del C:\CONTOSO\*.admp" 
    objShell.Run sCMD, 0, True 
    'Set objShell = nothing 
  
    ND = objShell.Run(Shellcmd,,True) 
        'Finally, we will create a success file.  We will inventory this file with SCCM so we can verify success. 
        Set objFile = objFSO.CreateTextFile(strSuccess, False) 
        objFile.Close 
  
Else 
    'We do nothing and end 
End If 
  
' Clean up. 
adoConnection.Close 
Set objGroupList = Nothing 
Set objRootDSE = Nothing 
Set adoCommand = Nothing 
Set adoConnection = Nothing 
Set adoRecordset = Nothing 
  
Function GetComputerName() 
    Dim WshNetwork 
    Set WshNetwork = WScript.CreateObject("WScript.Network") 
   ' default value 
    GetComputerName = "." 
    GetComputerName = WshNetwork.ComputerName 
End Function 
  
'The Function IsMember and the Sub LoadGroups are a more robust way to check for group membership 
'I have pulled these functions from http://www.rlmueller.net/Programs/IsMember6.txt 
Function IsMember(ByVal objADObject, ByVal strGroup) 
    ' Function to test for group membership. 
    ' objADObject is a user or computer object. 
    ' strGroup is the NT name (sAMAccountName) of the group to test. 
    ' objGroupList is a dictionary object, with global scope. 
    ' ADO is used to retrieve all group objects from the domain, with 
    ' their PrimaryGroupToken. Each objADObject has a PrimaryGroupID. 
    ' The group with the matching PrimaryGroupToken is the primary group. 
    ' Returns True if the user or computer is a member of the group. 
    ' Subroutine LoadGroups is called once for each different objADObject. 
  
    Dim strPrimaryGroup, strDNSDomain 
    Dim intPrimaryGroupToken, intPrimaryGroupID 
  
    If (IsEmpty(objGroupList) = True) Then 
       ' Create dictionary object. 
       Set objGroupList = CreateObject("Scripting.Dictionary") 
        objGroupList.CompareMode = vbTextCompare 
  
        ' Use ADO to retrieve all group "primaryGroupToken" values. 
        Set adoConnection = CreateObject("ADODB.Connection") 
        Set adoCommand = CreateObject("ADODB.Command") 
        adoConnection.Provider = "ADsDSOObject" 
        adoConnection.Open "Active Directory Provider" 
        Set adoCommand.ActiveConnection = adoConnection 
        adoCommand.Properties("Page Size") = 100 
        adoCommand.Properties("Timeout") = 30 
        adoCommand.Properties("Cache Results") = False 
        strAttributes = "sAMAccountName,primaryGroupToken" 
        Set objRootDSE = GetObject("LDAP://RootDSE") 
        strDNSDomain = objRootDSE.Get("defaultNamingContext") 
        strFilter = "(objectCategory=group)" 
        strQuery = "<LDAP://" & strDNSDomain & ">;" & strFilter & ";" _ 
            & strAttributes & ";subtree" 
        adoCommand.CommandText = strQuery 
        Set adoRecordset = adoCommand.Execute 
    End If 
    If (objGroupList.Exists(objADObject.sAMAccountName & "\") = False) Then 
       ' Call LoadGroups for each different objADObject. 
        ' Add object name to dictionary object so groups need only be 
        ' enumerated once. 
       Call LoadGroups(objADObject, objADObject) 
        objGroupList.Add objADObject.sAMAccountName & "\", True 
  
        ' Determine which group is the primary group for this object. 
       intPrimaryGroupID = objADObject.primaryGroupID 
        adoRecordset.MoveFirst 
        Do Until adoRecordset.EOF 
            intPrimaryGroupToken = adoRecordset.Fields("primaryGroupToken").Value 
            If (intPrimaryGroupToken = intPrimaryGroupID) Then 
                strPrimaryGroup = adoRecordset.Fields("sAMAccountName").Value 
                objGroupList.Add objADObject.sAMAccountName & "\" _ 
                    & strPrimaryGroup, True 
                Exit Do 
            End If 
            adoRecordset.MoveNext 
        Loop 
        adoRecordset.Close 
    End If 
  
   ' Check group membership. 
    IsMember = objGroupList.Exists(objADObject.sAMAccountName & "\" _ 
        & strGroup) 
End Function 
  
Sub LoadGroups(ByVal objPriADObject, ByVal objSubADObject) 
    ' Recursive subroutine to populate dictionary object with group 
    ' memberships. When this subroutine is first called by Function 
    ' IsMember, both objPriADObject and objSubADObject are the user or 
    ' computer object. On recursive calls objPriADObject still refers to the 
    ' user or computer object being tested, but objSubADObject will be a 
    ' group object. The dictionary object objGroupList keeps track of group 
    ' memberships for each user or computer separately. 
    ' For each group in the MemberOf collection, first check to see if 
    ' the group is already in the dictionary object. If it is not, add the 
    ' group to the dictionary object and recursively call this subroutine 
    ' again to enumerate any groups the group might be a member of (nested 
    ' groups). It is necessary to first check if the group is already in the 
    ' dictionary object to prevent an infinite loop if the group nesting is 
    ' "circular". The MemberOf collection does not include any "primary" 
    ' groups. 
  
   Dim colstrGroups, objGroup, j 
    colstrGroups = objSubADObject.memberOf 
    If (IsEmpty(colstrGroups) = True) Then 
        Exit Sub 
    End If 
    If (TypeName(colstrGroups) = "String") Then 
       ' Escape any forward slash characters, "/", with the backslash 
        ' escape character. All other characters that should be escaped are. 
        colstrGroups = Replace(colstrGroups, "/", "\/") 
        Set objGroup = GetObject("LDAP://" & colstrGroups) 
        If (objGroupList.Exists(objPriADObject.sAMAccountName & "\" _ 
                & objGroup.sAMAccountName) = False) Then 
            objGroupList.Add objPriADObject.sAMAccountName & "\" _ 
                & objGroup.sAMAccountName, True 
            Call LoadGroups(objPriADObject, objGroup) 
        End If 
        Set objGroup = Nothing 
        Exit Sub 
    End If 
    For j = 0 To UBound(colstrGroups) 
        ' Escape any forward slash characters, "/", with the backslash 
        ' escape character. All other characters that should be escaped are. 
        colstrGroups(j) = Replace(colstrGroups(j), "/", "\/") 
        Set objGroup = GetObject("LDAP://" & colstrGroups(j)) 
        If (objGroupList.Exists(objPriADObject.sAMAccountName & "\" _ 
                & objGroup.sAMAccountName) = False) Then 
            objGroupList.Add objPriADObject.sAMAccountName & "\" _ 
                & objGroup.sAMAccountName, True 
            Call LoadGroups(objPriADObject, objGroup) 
        End If 
    Next 
    Set objGroup = Nothing 
End Sub 