Reset local Windows account password (1.3.0+)

[x23piracy]

This is perfect for: https://forums.fogproject.org/post/76500

[Wayne Workman]

@x23piracy You didn’t know snapins could do powershell?

[x23piracy]

@Wayne-Workman really they can? well i am just a bit crazy today…

[alexf2132]

What do you have in text box: “Snapin Run With Argument”? Is it required for this specific Snapin? I noticed you didn’t mention that section of the Snapin creation process.

[Wayne Workman]

@alexf2132 When creating the snapin, if you choose the “Powershell” template, it’ll be filled in automatically for you. Also the arguments are listed in the Snapin Command part.

[alexf2132]

@Wayne-Workman Thank you sir.

[MRCUR]

https://technet.microsoft.com/en-us/library/security/3062591.aspx

[Wayne Workman]

@MRCUR That’s one of the options we thought about. It sets a unique password on every machine - and that’s not the greatest idea if you need to use the local account in a tight spot to do something, and don’t have LAPS readily open. LAPS was created as a way to manage local account passwords, specifically changing them. With the above simple PowerShell script paired with FOG Snapins, that’s an alternative to LAPS that isn’t so complex - and enables a uniform password on each computer.

[MRCUR]

@Wayne-Workman That’s the whole point - there should not be a single password set on all the machines. I realize this is not the point of your thread, but I just wanted to have this here so people know LAPS exists and is the preferred solution.

[Wayne Workman]

@MRCUR There should be - what the admin wants and is acceptable. Would I want a uniform password in every environment? No. I work in a public school, and very often I’m walking down the halls and someone comes out asking for help - and I don’t have my laptop with me. The less passwords I type in front of people, the better. Often, technicians fill in at other buildings - we don’t share AD credentials among technicians for our domains, but we do share local passwords with other techs so they can fill in where needed. LAPS would make that harder.

I would encourage people to use LAPS if they want the highest degree of local account security, but it would complicate my job further than I would like in my current position and slow my ability to solve problems.