RE: local admin account password

From: Mark Ribbans (mark.ribbans_at_ctel.com.au)
Date: 11/26/03

  • Next message: Eli Allen: "Re: local admin account password" 
    To: <focus-ms@securityfocus.com>
Date: Wed, 26 Nov 2003 13:58:40 +1030

    >Say you have more then 1000 systems, how do you handle the local admin
    >account password on the machines? (assuming it needs to be available for
    >extreme cases to get into the machine as you'd normally just use a domain
    login)

    >3) Use a password scheme where the password is basically the same on all
    box
    >except its based on something specific about the server. This means if
    >someone figures out the scheme (cracking a single box and figuring it out
    or
    >just gets told) they basically made this as good as the first idea I list.

    Hi,

    What i would do (and do do) is set up a password scheme as you suggested in
    option 3. Just keep the scheme\algorithm to yourself or your IT team.

    There are a number of ways you can get specific information regarding each
    specific PC, and you can then use part of this information as the password.
    Two good examples of this would be the CPU ID (if enabled in the BIOS -
    which you could then disable and then set a BIOS password too for added
    security?) and the MAC Address.

    To get the CPU ID you can query it with WMI:

    (just copy\paste into notepad and rename as CPU_ID.vbs)

    ----------------------------------------------------------
    Dim oWMI, oCPU

    Set oWMI = GetObject("winmgmts://")

       For Each oCPU In oWMI.instancesof("Win32_Processor")

            msgbox "Your CPU ID is: " & oCpu.processorid

       Next
    ----------------------------------------------------------

    To get the MAC address you can either do a ipconfig/all from a command
    prompt or do it with WMI:
    (just copy\paste into notepad and rename as MacAddress.vbs)

    ----------------------------------------------------------
    Dim oWMI, oNIC

    Set oWMI = GetObject("winmgmts://")

    For Each oNIC In oWMI.instancesof("Win32_NetworkAdapter")

            msgbox "Your MAC address is: " & oNIC.macaddress

    Next
    ----------------------------------------------------------

    WMI is very cool and you could even write a simple script or program to
    remotely retrieve this information from all your workstation very quickly. -
    If you were really clever you could probably even write the local admin
    passwords back to each box and do it all in one go! :)

    Hope this helps,
    Cheers,
    Mark Ribbans

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Eli Allen: "Re: local admin account password"

    Relevant Pages

    • RE: WMI for Windows XP
      ... how can I get WMI ... working on problematic Windows XP machines? ... The WMI component is a default component of the Windows XP system, ... Microsoft Online Community Support ...
      (microsoft.public.dotnet.general)
    • Re: using WMI for computer inventory
      ... I am going to be one of those people creating both the custom script (most likely an HTA... ... Someone whose opinion I respect says that he always tries to find another way to do the things that WMI does....especially in larger environments. ... WMI will have to be installed on pre Win2k/WinME machines. ... If you're just grabbing hardware info then this shouldn't be too much of a problem but if you're grabbing software info as well then you might want to run the wmi script or audit agent on the machine itself and just send back a compressed snapshot of all the info it found to your central inventory/server - rather than issuing the WQL receiving WQL result sets over the wire. ...
      (microsoft.public.windowsxp.wmi)
    • Still having problems with Win32_PnpDevice
      ... We have lots of customers that are having problems with our software when it tries to access Win32_PnpDevice from the WMI repository on Dell machines. ... After spending about 5 hours on the phone with Dell, the only thing we managed to ascertain with them (by reinstalling the operating system on one of the machines concerned) is that it's not hardware related. ...
      (microsoft.public.win32.programmer.wmi)
    • Re: Find Default Network Card NIC
      ... the code is identical on the two machines. ... For information about WMI you can start from the Microsoft Script Center ... Where NetConnectionID '' ...
      (microsoft.public.scripting.vbscript)
    • Re: using WMI for computer inventory
      ... >> My concern was that in a larger environment that WMI is too clunky ( ... > - WMI will have to be installed on pre Win2k/WinME machines. ... > you might want to run the wmi script or audit agent on the machine itself ... > central inventory/server - rather than issuing the WQL receiving WQL ...
      (microsoft.public.windowsxp.wmi)