Suitable Workaround for MS14-025: Vulnerability in Group Policy Preferences could allow elevation of privilege

hi,

we use gpp deploy local user account made member of local administrators group, admins use account local activities such first prep work of machine, rather logging in using domain admin account (yes of still manual us) times when domain isn't available authenticate domain account (laptops off site). deploy local admin account remote users use in case of troubleshooting, instance windows recovery environment perform system restore, start repair or other commands (this phone support scenario talk user through). in case, must provide user password. beauty of gpp can change password centrally, , next time gp refreshes local account gets updated password , helps ensure users aren't getting access local admin privileges during normal operation.

however, has changed since introduction of ms14-025 , can’t update passwords or create new local accounts, web link @ https://support.microsoft.com/en-us/kb/2962486 shows script setting random passwords, need know password in order use ourselves.

what looking for, logon script can following:

• check if local account exists – if not, create it, if set password of known password (not sure stored or how needs secured)
• check if local account belongs specified group, if doesn’t – add it, if it’s in groups shouldn’t remove them groups
• the script can contain list of accounts should disabled or deleted, if account exists , shouldn’t, delete/disable it

i don’t know start because script ms has provided in above link useless our scenario. if did automate system builds (which did @ previous company) still don’t have means of updating passwords should change afterwards. wouldn't problem if machines authenticate domain, can if director’s laptop can’t boot , he’s not in office week? happened yesterday due windows updates installation, corrupted key file dwmapi.dll had no choice provide him password , talk him through system restore steps on phone.

has got ideas or solutions work around this, there 3rd party products (preferably free) same thing?

many thanks

steve

hi sir,

i tested .bat file in lab (check if user account memeber of administrators , reset password):

@echo off set a=test set p=password0! set g=administrators net user %a% >nul 2>nul && goto check_group || goto add_join  :check_group net user %a% | find /i "%g%" >nul 2>nul && goto reset_pw || goto join_group  :join_group net user %a% %p% >nul 2>nul net localgroup %g% %a% /add >nul 2>nul exit  :add_join net user %a% %p% /add >nul 2>nul net localgroup %g% %a% /add >nul 2>nul exit  :reset_pw net user %a% %p% >nul 2>nul exit 

in addition ,variable user name , p password , g group .

best regards,

elton ji

---

please remember mark replies answers if , unmark them if provide no help. if have feedback technet subscriber support, contact tnmff@microsoft.com .

Windows Server  >  Group Policy