Changing/Managing Service Passwords
Last Updated: 28 Dec 2004
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*** PLEASE NOTE: Link(s), If Provided, May Be Wrapped ***
Here are some utilities for changing the passwords of your
service accounts across multiple machines:
TOOLS
• ChangePasswd ........... http://www.quimeras.com/Products/products.asp
• DC Pwd Changer ......... http://www.danish-company.com/dcpc/
• ECM - Service Control .. http://www.serverware.com/
• Enterprise Config Mgr .. http://www.configuresoft.com/product_ecm_overview.htm
• LAPM ................... http://www.foghornsecurity.com/lapm/download
• Network Pwd Changer .... http://www.brothersoft.com/Utilities_Security_Network_Password_Changer_21056.html
• Password Assistant ..... http://www.netikus.net/products_nttoolkit.html
• PSPASSWD ............... http://www.sysinternals.com/ntw2k/freeware/pstools.shtml
• Service Acct Mgr ....... http://www.lanicu.com/products/nt_frame.htm
• Service Explorer ....... http://www.smallwonders.com/eng/products/serviceexplorer/main.asp
• ServiceSecure .......... http://www.netikus.net/products_nttoolkit.html
• Setup Batcher .......... http://www.admwin.com/
SCRIPTS & CLI TOOLS
• DSADD .................. Native Command
• DSMOD .................. Native Command
• DSQUERY ................ Native Command
• http://www.gbordier.com/gbtools/index.htm
• http://www.jsiinc.com/SUBA/TIP0300/rh0349.htm
• http://www.jsiinc.com/SUBA/TIP0100/rh0199.htm
• http://www.jsiinc.com/SUBF/Tip2500/rh2501.htm
• http://labmice.techtarget.com/windows2000/Administration/password.htm
• http://techrepublic.com.com/5100-6268_11-5198818.html?tag=search
• http://www.microsoft.com/windowsxp/home/using/productdoc/en/dsmod.asp
RESOURCES (DEFAULT PASSWORDS & PASSWORD RECOVERY)
• http://www.elcomsoft.com/
• http://www.lostpassword.com/
• http://www.atstake.com/lc4/
• http://www.csystem.net/password.htm
ACCOUNT LOCKOUT AND MANAGEMENT TOOLS
• http://www.microsoft.com/technet/prodtechnol/windowsserver2003/maintain/operate/BPACTLCK.asp
• http://www.microsoft.com/downloads/details.aspx?FamilyID=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en
WHITEPAPERS & TECH DOCUMENTS
• http://www.winnetmag.com/WindowsSecurity/Article/ArticleID/37438/37438.html
• http://www.winnetmag.com/Articles/Index.cfm?ArticleID=3687
• http://support.microsoft.com/?KBID=272530
• http://support.microsoft.com/?KBID=157780
• http://support.microsoft.com/?KBID=135403
• http://msdn.microsoft.com/library/officedev/modadmin/deconchangingsqlserveradministratorlogin.htm
• http://msdn.microsoft.com/library/en-us/sql64/in_configure64_0dpv.asp
• http://www.microsoft.com/windowsxp/home/using/productdoc/en/dsmod.asp
SCRIPTING SAMPLES
You can also generate a random password, if you had such
a requirement. A number of random-text generators can be
found at the following location:
• http://www.google.com/search?q=random%20text%20generator
1. Send the output to RANDOM.TXT
2. Use the command below to change the password:
~~~~~~~~~~~~~~~
FOR /F %%V IN (RANDOM.TXT) DO cusrmgr -u AdminAcct -P %%V
~~~~~~~~~~~~~~~
If you want to run the script against multiple accounts,
the use two columns in the input file - the first one
being the Account Name, and the second one being the
randomized password. Then, use the following command
(again, all on a single line):
~~~~~~~~~~~~~~~
FOR /F "TOKENS=1-2" %%V IN (RANDOM.TXT) DO cusrmgr -u %%V -P %%W
~~~~~~~~~~~~~~~
The following script sample will generate random passwords
of a predetermined length for user names found in a list,
and will output the names and the passwords to a separate
file:
~~~~~~~~~~~~~~~
FOR /F "TOKENS=*" %%U IN (LIST.TXT) DO FOR /F "TOKENS=*" %%P IN ('NET USER "%%U" /RANDOM:10 ^| FIND "Password"') DO @ECHO %%P >>OUTPUT.TXT
TYPE OUTPUT.TXT
~~~~~~~~~~~~~~~
PERSONAL NOTES
• XP/2003 have new native commands that allow you to
query, add or modify various account information locally
or in Active Directory:
DSQUERY
DSADD
DSMOD
• The NET USER command supports a /RANDOM parameter which
will generate a random complex password. If you use the
paramater as /RANDOM:xx it will generate a password of
the length represented by XX.
• This scripts linked below can easily be adapted
to handle other User Manager type issues, such as
viewing or changing Service Account passwords, or
Adding a group to all systems in the domain.
