GPO, greyed-out field

Hi,

I have a simple idea: install GPMC on a workstation and make the GPP change from that workstation, don't do it directly on a DC. You might have more success this way.
The fact that it is grayed out may be a rights issue...

Make sure not to link the GPO to the domain, but to an OU that contains the machines for which you want to change the password. (in short, do not target your DCs or your servers).
You should have different local admin passwords for your workstations and your servers.

-

Otherwise, I do not recommend proceeding this way (using this method, GGP) to do this.

Here we are working with GPP, and when we use GPPs, all the passwords entered in the GPP (changing the password of a local account, mapping a network drive with a specific account, etc.) are stored in the GPP.

However, it is encrypted with algorithms that Microsoft published a few years ago.

A simple user can therefore find the password of an account referenced in a GPP. With a simple script, one can retrieve a specific XML stored in SYSVOL, which everyone can read... and inside it, there is the encrypted password.
We retrieve the encrypted password, run a script, and voila...

The key published by MS:
http://msdn.microsoft.com/en-us/library/2c15cbf0-f086-4c74-8b70-1f2fa45dd4be.aspx

A little article:
http://www.grouppolicy.biz/2013/11/why-passwords-in-group-policy-preference-are-very-bad/

You will surely find scripts to decrypt it online... Get-GPPPassword....

-

So if you manage to get your GPO working, you need to delete the GPO that contains the GPP parameter once you're done. This will prevent the password from being stored in an XML.
Knowing that a GPP is applied once, you don’t need to keep the GPO active, so deleting it removes the XML.
However, this implies that in the production chain of a machine (mastering), the password should be managed at that level for new stations.

-

Another solution would be to create a script (PS or VBS) that resets the local admin password... I think there are plenty of examples online.

See you later!

Hello, and thank you for your response!

Install GPMC on a workstation and make the GPP modification from that workstation; do not do it directly on a DC. You might have more success that way.

I think I'm going to look in that direction, indeed. However, there's an issue with permissions, as even with the domain Admin account, I can't access these fields, which seems strange to me.

You tell me that this is not the right method, but if I do it through a script, do users also have access to that script with the password in plain text? Because in order to execute it, they will also need at least read access, right? I'm not disputing what you're saying. Far from that idea. I'm just trying to understand.

As for applying the GPO, yes, I will apply it to user workstations and not to servers; that is already planned, and I have already organized my AD for it to work that way :)

Thank you anyway for taking the time to explain all this in detail; I will also look into the links you provided.

I will give you feedback on what I've done to make the operation work!

See you later.