The log only shows “Action command line: smsswd.exe /run: net user administrator %ADMPW%” Reviewing the SMSTS.log helps validate that the password is not exposed. Now, call the NET USER command line with the variable

Select OK to save/close the variable properties, then look at it again and notice that the value is quite different than what you’ve typed. Set a Task Sequence Variable named “ADMPW” or similar, enter the clear text value, then enable the “Secret value” check box. Besides, wouldn’t the command including the password be exposed in SMSTS.log? Not if a “Secret Value” Task Sequence Variable is used!įollow these steps in configuring a Task Sequence: Turning to the Task Sequence discussion option, a suggestion was made to call NET USER from a Run Command action. The embedded script used a simple Base64 conversion to obfuscate the password and the password was not exposed on the command line, but there was no actual encryption. I’ve created a Compliance Setting and Baseline for a customer in a situation where they had ConfigMgr clients on workgroups and joined to domains which they could not manage.

A Task Sequence deployment with a script which has an embedded password.

A Compliance Setting and Baseline with a script a script which has an embedded password or uses a password formula / calculation.

Application or Package deployment with a script which has an embedded password or uses a password formula / calculation.

While discussing the ConfigMgr options with a few colleagues we came up with the following:

ConfigMgr (SCCM / Microsoft System Center Configuration Manager) deployment.

Microsoft Local Administrator Password Solution (LAPS) is a great free solution which should be seriously considered.

MS14-025 includes a lengthy PowerShell script which will reach-out to remote computers to change the password and log the change in a central text file.

There are many options to handle managing local account passwords including: Instead they removed the ability for GPP to save user names and passwords in Local Users and Groups, Drive Maps, Scheduled Tasks, Services, and Data Sources. But Microsoft didn’t fix the vulnerability. However, some time ago the process was was discovered to have a significant venerability and Microsoft released security bulletin MS14-025 to address the issue. At one time it became routine to manage Windows local account passwords with a Group Policy Preference.

Sccm ts where is used local admin