Change Local Admin Password Remotely

Microsoft disabled changing the local admin account of computers via GPO due to a security vulnerability. This link goes into further detail regarding this issue: MS14-025-Vulnerability

If you want to change passwords remotely on your environments computers, the following script can be used.

Before running, you’ll want to generate a text file of the machines you are targeting with the script. One great thing about this script is the password typed in the PowerShell window is encrypted and not passed through plain text to the targeted machines.

A few things to note:

• You can play with the -count number if the script fails due to slow network
• You can add in multiple accounts by adding them to $Computer/YourAdminAccountName, YourSecondAccount, YourThird

$computers = Get-Content -path "C:\computers.txt"
$password = Read-Host -prompt "Enter new password for user" -assecurestring
$decodedpassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($password))
foreach ($Computer in $Computers) {
$Computer = $Computer.toupper()
$Isonline = "OFFLINE"
$Status = "SUCCESS"
$StatsError ="Failed"
if((Test-Connection -ComputerName $Computer -count 1 -ErrorAction 0)) {
$Isonline = "ONLINE"
} else { $StatsError= "`t$Computer is OFFLINE" }

try {
$account = [ADSI]("WinNT://$Computer/YourAdminAccountName")
$account.psbase.invoke("setpassword",$decodedpassword)
$StatsError="Administrator Password changed successfully"
}
catch {
$status = "FAILED"
$StatsError="$_"
}

$obj = New-Object -TypeName PSObject -Property @{
ComputerName = $Computer
IsOnline = $Isonline
PasswordChangeStatus = $Status
DetailedStatus=$StatsError
}

$obj | Select ComputerName, IsOnline, PasswordChangeStatus,DetailedStatus
$obj | Export-Csv -Append -Path "C:\output.csv"
}