Enclosed is a script that I wrote a short while ago to do precisely that, it
requires the Windows 2000 setpwd.EXE binary.
Dean
--
Dean Wells
MSEtechnology
* Email: [EMAIL PROTECTED]
http://msetechnology.com
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Medeiros, Jose
Sent: Friday, August 05, 2005 1:30 PM
To: [email protected]
Subject: [ActiveDir] Changing a authoritative restore password on a DC
Greetings,
Quick question, does any one ever change their initial password used when
they installed Active Directory? If so do you use a third party tool to
automate the password change across all the controllers or is this some
thing that is easily scriptable?
Sincerely,
Jose Medeiros
408-449-6621 Cell
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
:: Forest wide DSRM password reset script / Dean Wells / MSEtechnology / Jun.
2005
:: Script determines all DCs within a specified forest and resets their DSRM
password to the supplied value
:: - script depends upon SETPWD.EXE found ONLY in Windows 2000
@echo off
if "%2"=="" goto :HELP
if "%2"=="/?" goto :HELP
if not "%3"=="" goto :HELP
setlocal ENABLEDELAYEDEXPANSION
cls
echo/
:: Locate critical executables
for %%e in (setpwd.exe ldifde.exe find.exe) do (
set where="%%~$PATH:e"
if "!where!"=="""" (
echo ERROR - Required executable, "%%e", not located within the
path
goto :EOF
)
)
set DSADNS=
set FQDN=%1
set ROOT=dc=%fqdn:.=,dc=%
set PWD=%2
echo STATUS - Attempting DSRM reset on all DCs within Forest "%FQDN%" ...
echo/
echo * Running on %COMPUTERNAME%
echo * Obtaining list of Domain Controllers from "%ROOT%"
echo/
ldifde -j %TEMP% -s %FQDN% -d cn=configuration,%ROOT% -r (objectClass=server)
-l dnshostname -f %TEMP%\servers.log >nul
if errorlevel 1 (
echo ERROR - LDAP query failed enumerating list of Domain Controllers
goto :EOF
)
title DSRM forest-wide password reset ...
:: Parse the servers and trigger all processes
for /f "tokens=2 delims=: " %%h in ('type %TEMP%\servers.log ^| find /i
"dnshostname: "') do (
set DSADNS=%%h
if not "!DSADNS!"=="" (
call :SPAWNRESET !DSADNS!
)
)
:: All done
echo/
echo STATUS - Process complete.
title Command Prompt
goto :EOF
:SPAWNRESET
set /p = - !DSADNS! ... <nul
setpwd /s:%1 /p:%PWD% >nul
if not errorlevel 1 (
echo SUCCEEDED
) else (
echo FAILED^!
)
goto :EOF
:HELP
echo/
echo SYNTAX - %0 ^<Forest Root FQDN^> ^<DSRM password^>
echo/
echo PURPOSE - Script determines all DCs in the supplied forest and
echo resets their DSRM password to the supplied value.
echo/
echo * Requires Windows 2000 SETPWD.EXE within path
echo * Requires sufficient security context
goto :EOF
