W2008 Forrest - local admin password

Hey!

current status:
- I have a forrest with 12 W2008 DCs
- 8 different sites ( ~ 600 computers /site , more on HQ )
- local workstation admins


problem :
- i wanna mass set a password / site for local administrator on each workstation
- change this password every 2 weeks let`s say


solution:
- using psexec ( psexec @file net user administrator p@$$w0rd )

problem that arise : using that command i`ll be able to set the password for all systems that are online, the part that is closed ain`t going to get the password updated.

I am thinking of implementing a logon script set in "default X site policy" to run a vbs that will set a password from a file. ( problem here is that somebody inteligent will be able to follow the script code and find the passwords... ) .

The improved idea is to place that file in the normal sysvol\scripts but with a denied to "Authenticated Users" as a permission to that file, as the script is intended to computer policy.

Any better idea?

 

If you write your script in VBScript, you should have all the coding tools available to that scripting language. These include encoding tools:

http://www.microsoft.com/technet/scriptcenter/resources/qanda/mar06/hey0309.mspx