Renaming administrator account 1

[secutanudu]

We are not currently in a domain, all users log into their machines locally.

We want to rename the administrator account, as well as create a second administrator account (and set the password).

We also want to enforce password policies for all local accounts.

I know this can be done via group policy, but is there any way to script or batch it so we do not have to go to every machine (~400) manually? Can we make these changes in the registry directly or somehow script local group policy changes?

Thanks,
Andrew

 

[bcastner]

Add a new user and make them a member of Group Administrators:

net user <username> <password> /add /active:yes
Example:
net user secutanudu tektips /add /active:yes
Reference:

http://support.microsoft.com/default.aspx?scid=kb;en-us;251394

Now make them members of the Administrator Group:

net localgroup <local group> <local account> /<ADD>
Example:
net localgroup administrators secutandudu /ADD
Reference:
net localgroups /?

In the alteranative, you could use addusers.exe:
Reference:

http://www.windowsnetworking.com/nt/atips/atips34.shtml

Download:

http://www.dynawell.com/reskit/microsoft/win2000/addusers.zip

Followed by the Add Users to Group utility:
Reference:

http://www.windowsnetworking.com/kb...sefulforaddinguserstolocalorglobalgroups.html

Download:

http://www.dynawell.com/reskit/microsoft/win2000/usrtogrp.zip

Finally, renaming the default Administrator account is slightly more complicated. You would use the utility cusmrgr.exe:

Reference:

http://www.jsiinc.com/SUBE/Tip2400/rh2445.htm

http://www.windowsitpro.com/Windows/Article/ArticleID/24210/24210.html

Download:

http://www.dynawell.com/support/ResKit/download/w2kcusrmgr.asp

Something else that might help:
PSExec:

http://www.sysinternals.com/ntw2k/freeware/psexec.shtml

 

[secutanudu]

Excellent - just succefully added an admin and added it to the group - i gotta try renaming the administrator account. I guess if it is very complicated we can just do it manually with group policy.

One more thing - is it possible to change password complexity/length requirements without manually going into group policy? Is that a reg setting soemwhere?

 

[bcastner]

It is complicated because you cannot use the CSV list features of the middle set of tools.

Passprop.exe
Reference:
PASSPROP [/complex] [/simple] [/adminlockout] [/noadminlockout]

/complex - Forces you to enter passwords that are complex (i.e., requiring passwords to be a mix of upper- and lowercase letters and numbers or symbols)
/simple - Lets you enter simple passwords
/adminlockout - Lets you lock out the Administrator account (the Administrator account can still log on interactively on domain controllers)
/noadminlockout - Doesn't let you lock out the Administrator account

"So why would you want to lock out the Administrator account? The main reason is to restrict hackers from using Administrator account backdoors to break into your NT system. If you lock out the Administrator account, you can use it only to log on interactively on domain controllers--network logons and logons to non-domain controllers will fail."



Download:

http://www.dynawell.com/reskit/microsoft/win2000/passprop.zip

 

[secutanudu]

bcastner: that works great (passprop.exe) but is there a way to set password length requirements as well as complexity?

 

[bcastner]

Yes, use the full option set of this instead of passpol.exe:

http://support.microsoft.com/default.aspx?scid=kb;en-us;251394

 

[secutanudu]

What is passprop.exe doing? Does it modify the registry? I noticed that group policy is unchanged after running passprop.

Do you know if there is a way to simply script local group policy changes (similar to importing a .reg file) instead of doing it by hand?

 

[bcastner]

Purchase a Windows Server product and create a Domain?

Some things you can try in a stand-alone/Workgroup setting.

. You can use Secedit.exe to export a modified set of local policy templates, and Import them elesewhere;

. You can in many cases write your own ADM files, if the local security policy is registry based and not ACL or ACE based.

. Doug Knox, MVP has a usefull utility, and the modest paid version will operate on remote machines to duplicate settings. It may not encompass all of the policy objects you want to change, but it is very usefull:

http://www.dougknox.com/xp/utils/xp_securityconsole.htm

. You can copy the secpol.pol file. While this KB article is not directly on your point, it shows how to do at least that step:

http://support.microsoft.com/?kbid=315675

. See EE member "midglio"'s comments on replicating local security policy in a Workgroup:

http://www.experts-exchange.com/Security/Win_Security/Q_20705435.html

 

[secutanudu]

Thanks - we actually do have win2000 server, we plan to upgrade the network to Active directory at some point over the next few months. We're getting this security stuff thrown on us and we need to do it ASAP....thanks for the help.

 

[bcastner]

You are very welcome.

Best wishes,
Bill Castner

 

[secutanudu]

Bill - I've been looking at the help for secedit /export - it's throughly confused me. Is there a way to export a specific set of policy items to import elsewhere?

 

[bcastner]

Not the most intuitive tool to use. The example below sets a password complexity level:

http://www.governmentsecurity.org/a...idetoUsingtheSecurityConfigurationToolSet.php