Local User GPO - change?

wrx7m

I ran into this problem a few months ago, though some time after an upgrade of the AD schema from 47 to 69.

I solved it by using a bat file that runs as a startup script right after an MDT deployment.

net user "My Admin" PasswordGoesHere /add /passwordreq:yes /fullname:"My Admin"
net localgroup Administrators "My Admin" /add

After the new PC is then moved to its final OU, LAPS is installed and a new random password is applied.

bbigford

@wrx7m said:

I ran into this problem a few months ago, though some time after an upgrade of the AD schema from 47 to 69.

I solved it by using a bat file that runs as a startup script right after an MDT deployment.

net user "My Admin" PasswordGoesHere /add /passwordreq:yes /fullname:"My Admin"
net localgroup Administrators "My Admin" /add

After the new PC is then moved to its final OU, LAPS is installed and a new random password is applied.

Hypothetically, what if you had to run LAPS against 100 servers? Growing by 10 servers every month and you don't build them all, so you don't know if the passwords are all getting set locally with the right password ... Would you still feel that is the best tool since you can't run LAPS against groups of servers like an OU?

wrx7m

@BBigford Laps won't let you set the password. It assigns random ones that you can access the plain text version of via AD.

bbigford

@wrx7m said:

@BBigford Laps won't let you set the password. It assigns random ones that you can access the plain text version of via AD.

Well that's disappointing. Sounds like a pretty useless program. You can only do random ones, and one at a time.

wrx7m

@BBigford It does everything automatically, via GPO, not really one at a time. LAPS prevents each local admin from having the same password. Obviously, if you want everything to be the same then you wouldn't want to use it.

EDIT: You can still use the bat file (mentioned above) if you want to create a specific user with a specific password and assign it to the local admins group. Keep in mind that it is plain text, as was the method you were previously using.