Real-World Scripting: Testing and Changing Administrator Account Passwords

Download and install the Perl for Win32 and Win32::AdminMisc extensions on the NT server or workstation where the script will run. Perl for Win32 is available as part of ActiveState's free ActivePerl package (http://www.activestate.com/activeperl). I used ActivePerl build 518 to create this script. You can use the Perl Package Manager (PPM) to keep your extensions up-to-date. Consult the ppm.html file in the perlhtml directory for installation.

The Win32::AdminMisc extension is available as a free download on the Roth Consulting Web site (http://www.roth.net/perl). The Win32::Admin Misc page (http://www.roth.net/perl/adminmisc) contains extensive documentation for the UserCheckPassword and UserChangePassword functions. Carefully review this documentation to ensure that the password policies in your environment won't cause these functions to fail.

ActivePerl installs easily from a self-extracting executable. To install the Win32::AdminMisc extension, follow the instructions in the README file. The ActivePerl and Roth Consulting Web sites include online documentation for their respective extensions. These sites also have online documentation about using Perl in Win32 systems, so they are excellent resources. In addition, Dave Roth's Win32 Perl Programming: The Standard Extensions (Macmillan Technical Publishing, 1999) is valuable because it contains extensive examples of Perl scripts for systems administrators.

Use the GetServers function to dynamically obtain a list of machines in your domain. To specify the types of machines you want to include in the list, use the appropriate constants. Commonly used constants are

The Roth Consulting Web site has the complete list of constants. You can use more than one constant by linking them together with the pipe (|) character, as callout A in Listing 1 shows.

Determine and specify the location for passlog.txt. This file contains the log of successes (i.e., tested password is correct) and failures (i.e., tested password is incorrect or the server was unavailable). Screen 1 contains example passlog.txt output.

When you specify the path for passlog.txt in the script, use double backslashes instead of single backslashes (e.g., C:\temp\passlog.txt instead of C:temppasslog.txt). If you prefer, you can write the success and failure logs to separate files or change the output from a text format to a Comma Separated Values (CSV) format. Using the CSV format is helpful if you administer numerous nodes because you can easily open CSV files in Microsoft Excel. TestPW.pl contains example code for writing the logs in a CSV file. I included this code as a comment, so if you want to use it, you need to remove the comment symbol (#) from the line that callout B in Listing 1 highlights.

Find out your lockout policy number if you don't know it. The UserCheckPassword function attempts to change the password and reports the success or failure of that action. Consequently, if you execute the script repeatedly with incorrect passwords on some servers, you might lock out accounts if the number of times you run the script equals the lockout policy number that the Account Policy interface window specifies. You can review the Account Policy settings in User Manager. Select Policies and Account to check the password lockout settings. Account lockout doesn't affect the Administrator account unless you have modified your security settings. TestPW.pl offers guidelines on how to avoid lockout problems.

Drag the script to a Command Prompt window to test it. The script will test for the domain, Administrator account name, and password that you specify. If the script executes successfully, you'll receive output in passlog.txt and on screen.

Perl scripts can fail to run in the Command Prompt window if the path to their location contains spaces. If the script doesn't run, use double quotation marks to enclose either the phrase containing the spaces (e.g., C:winntprofilesrlewispersonal"my scripts"testpw.pl) or the entire path (e.g., "C:winntprofiles rlewispersonalmy scriptstestpw.pl").

Test ChangePW.pl and ChangePWList.pl to determine which script is best for your environment. If you use an input file, you'll have greater control over the servers you're targeting for password changes than if you use the GetServers function. However, you need to update the input file whenever you change any servers in your domain. When you use the GetServers function, you don't need to update any files.

To test ChangePW.pl, specify the appropriate constants to show the types of machines you want the list to include. Use the same constants that I discussed in step 2 in the TestPW.pl section. To test ChangePWList.pl, prepare the input file serverlist.txt. As Screen 2 shows, list the machines you want to include, placing one machine name per line. In ChangePWList.pl, specify the location of the input file. Remember to use double backslashes instead of single backslashes in the path.

Be aware that using ChangePWList.pl to change passwords on domain controllers (PDCs and BDCs) can cause unpredictable results. Changing BDC passwords isn't necessary or advisable because their local SAM is the domain SAM and they will reflect changes you make to the PDC. Changing the Administrator password on the PDC while you're running the script can cause the script to fail if you're running the script in a user's context.

Determine and specify the location for passchangelog.txt. Remember to use double backslashes in your path. As in TestPW.pl, you can write the success and failure logs to separate files or change the output to a CSV format.

Drag the script to a Command Prompt window to test it. If the script doesn't run, use double quotation marks to enclose any spaces in the path. If the script runs successfully, the script will change the local Administrator account password to the one you specified. You'll receive output in passchangelog.txt and on screen. Check the output for servers that weren't available or wouldn't accept the password change. If the password change failed, you need to investigate why. Failures can occur if you have insufficient Administrative authority on the target server or if a connectivity issue caused the password change to fail.

After you've completed your password changes, run the TestPW.pl script to verify that all the passwords on all the targeted machines are consistent.