Managing The Local Administrator Password - Part 1 - The Issue

Local administrator password has always been a cause of a headache for security professionals. There hasn’t been a good and free way to manage the password on a large scale and most organizations ended up using the same password on all desktops or even servers. This introduces a number of vulnerabilities, such as:

• All IT Staff know the password
• The password is never changed
• The password inevitably becomes known to the users and various 3rd parties
• Machines are exposed to pass-the-hash attacks 

If an attacker, a malware or an evil insider gains access to a single machine currently logged on under the local admin account they will be able to access all machines by executing a script or using built-in management tools. Moreover, compromise of a single machine will allow an attacker to grab a password hash and use it to access other computers.

The local administrator password can be managed using Group Policy Preferences as detailed in the following article: 

https://social.technet.microsoft.com/wiki/contents/articles/1827.active-directory-how-to-change-the-local-administrator-password-on-domain-member-computers-dsforum2wiki.aspx

While this satisfies most compliance requirements (they generally only require that passwords are changed at a set interval), this still leaves all computers with a single password. Furthermore, Group Policy Preferences store encrypted passwords in the SYSVOL folder and the encryption key is published on MSDN:

http://msdn.microsoft.com/en-us/library/cc422924.aspx

Clear text passwords can be retrieved from Group Policy Preferences using a PowerShell script as detailed in the article below:

http://obscuresecurity.blogspot.com/2013/07/get-gpppassword.html 

Summarizing, GPO Preference is not a good solution.

As to other solutions, there is one from SANS. I haven’t explored it but it does look comprehensive:

http://www.sans.org/windows-security/2013/08/01/reset-local-administrator-password-automatically-with-a-different-password-across-the-enterprise