Set local password with secure startup script

Question

Since CPassword has been deprecated by MSFT, I need a secure method to set the password of the local administrator on all workstations. The workaround script that MSFT provided in
the kb article won't work because I have no control over when a computer is on or off. Hence my desire to use a startup script. I logon script would be fine too, but I suspect that wouldn't work since the
end users don't have access to set these passwords.
I can set the password with these commands:
$objUser = [ADSI]"WinNT://./LocalAdmin"
$objUser.SetPassword("NewPassword")
but that exposes the password in the script in plain text, which is worse than the CPassword problem that MSFT "fixed."
So, how can I do this same thing and use a predetermined password without putting it into a logon/startup script in plain text?
Thanks in advance!
Blog /
Facebook / Twitter

Answer 1

Ha, that's also what I'm doing right now.  The simplest way to eliminate most of the threats, in my opinion, is:
1) move the script to a separate file share (since Domain\NetLogon is definitely a main target for hackers), and
2) set the permissions to allow Domain Computers Read Only.  This will eliminate most of the threats.
If you're still not comfortable having the password in plain text, use the native PS Encryption (Convertto-SecureString and
Convertfrom-SecureString) and use your own key.
Dave Wyatt has a very informative post on this topic:
http://powershell.org/wp/2014/02/01/revisited-powershell-and-encryption/comment-page-1/
Remember this is not a 100% hacker proof solution, but should be good enough to keep away the novices.