Disabling local user accounts on remote servers

Disabling local user accounts on remote servers
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Disabling local user accounts on remote servers James 06-29-2006
Posted by =?Utf-8?B?SmFtZXM=?= on June 29, 2006, 9:51 am
If you were  Registered and logged in, you could reply and use other advanced thread options
I have a local user account that is a member of the local admins group on
over 100 hundred servers. I would like to disable this local account from a
central location (my pc) instead of logging into each server and manually
disabling. I am a domain admin.

I would also prefer not to do this by using computer management and
connecting to the servers I want to disable the account on.

If I cannot do this i'd like to at least be able to change the password of
this local user account from my pc instead of logging into each server. Can
this be done with a script or batch file. If so can anyone provide some
sample code as I am not very familiar with writing scripts?

Posted by Steven L Umbach on June 29, 2006, 7:16 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
You could use a Group Policy startup script and then use the net user
command to disable the account but that would require that every server be
restarted. There is a fee utility from SysInternals called PsPasswd that
would allow you to write a batch file to change the password on each server
assuming the server is available to you via file and print sharing
connectivity. You can use the command with a text file containing the fully
qualified name of each server. You could also do something similar with
PsExec where you use the command net user username to disable the user
account as in net user steve /active:no. If the user account only exists on
the servers or you don't care about other computers you could even use the
wildcard option. I have not used either with a list myself so I don't know
offhand if you get a confirmation message or error message if a computer in
the list can not be contacted but you could test that out. You may also want
to post in a Windows scripting newsgroup. --- Steve

http://www.sysinternals.com/Utilities/PsPasswd.html -- PsPasswd
http://www.sysinternals.com/Utilities/PsExec.html --- PsExec

>I have a local user account that is a member of the local admins group on
> over 100 hundred servers. I would like to disable this local account from
> a
> central location (my pc) instead of logging into each server and manually
> disabling. I am a domain admin.
>
> I would also prefer not to do this by using computer management and
> connecting to the servers I want to disable the account on.
>
> If I cannot do this i'd like to at least be able to change the password of
> this local user account from my pc instead of logging into each server.
> Can
> this be done with a script or batch file. If so can anyone provide some
> sample code as I am not very familiar with writing scripts?



Posted by Roger Abell [MVP] on June 29, 2006, 9:30 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I would have to hack it out from other scripts, but this is certainly
something one could do. However, you also stated
"prefer not to do this by using computer management"
but technically speaking this would be using the same remote
management ports as the MS provided remote consoles.
So, if you stated that due to network ports availability then
script would likely not be your solution either.

>I have a local user account that is a member of the local admins group on
> over 100 hundred servers. I would like to disable this local account from
> a
> central location (my pc) instead of logging into each server and manually
> disabling. I am a domain admin.
>
> I would also prefer not to do this by using computer management and
> connecting to the servers I want to disable the account on.
>
> If I cannot do this i'd like to at least be able to change the password of
> this local user account from my pc instead of logging into each server.
> Can
> this be done with a script or batch file. If so can anyone provide some
> sample code as I am not very familiar with writing scripts?



Posted by =?Utf-8?B?SmFtZXM=?= on June 30, 2006, 9:09 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Thanks for the reply. I understand its using the same ports but the manual
work is what I don't want to do. There will be instances where we'll have to
change the local admin passwords on these servers or workstations
periodically so a script would be ideal.

"Roger Abell [MVP]" wrote:

> I would have to hack it out from other scripts, but this is certainly
> something one could do. However, you also stated
> "prefer not to do this by using computer management"
> but technically speaking this would be using the same remote
> management ports as the MS provided remote consoles.
> So, if you stated that due to network ports availability then
> script would likely not be your solution either.
>
> >I have a local user account that is a member of the local admins group on
> > over 100 hundred servers. I would like to disable this local account from
> > a
> > central location (my pc) instead of logging into each server and manually
> > disabling. I am a domain admin.
> >
> > I would also prefer not to do this by using computer management and
> > connecting to the servers I want to disable the account on.
> >
> > If I cannot do this i'd like to at least be able to change the password of
> > this local user account from my pc instead of logging into each server.
> > Can
> > this be done with a script or batch file. If so can anyone provide some
> > sample code as I am not very familiar with writing scripts?
>
>
>

Similar ThreadsPosted
User Profiles being automatically created for local user accounts March 24, 2006, 9:45 am
disabling FW with user account December 1, 2005, 2:11 am
How do I manage local admin accounts without a domain or ADS? November 16, 2005, 6:22 pm
What accounts/groups in Local Admin group June 16, 2008, 9:34 am
Locked servers and Remote Desktops Snap-In September 14, 2006, 1:41 pm
user accounts November 28, 2007, 1:37 pm
Locking user accounts when inactive August 22, 2005, 6:04 am
Report on administrator user accounts.... January 25, 2007, 4:16 am
IEEE 802.1x for Domain user accounts only May 21, 2007, 2:29 pm
Re: transfer user accounts because of hardware upgrade October 7, 2005, 7:10 am

The site map in XML format XML site map

Contact Us | Privacy Policy