| |
How to assign or reset computer account's password? |
|
|
Subject: How to assign or reset computer account's password?
Author: authen
In response to: How to create NTLMv2 computer account?
Posted on: 05/06/2014 10:54:57 PM
For AD2008 or later
Click on "Start" and then "Run.."
Type "adsiedit.msc" to open ADSI console
Browse to your computer account and right click on it
Choose "Reset Password..."
Follow the wizard to finish.
For AD2003 or older
For AD2003 or older, there is no user interface to reset password for computer account. You have to manually run the script as below:
C:\>cscript SetComputerPass.vbs CN=<servicename>,CN=Computers,DC=<domain>
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
Password:<password>
C:\>
For your reference, here is the code of SetComputerPass.vbs
Option Explicit
Dim strDn, objPassword, strPassword, objComputer
If WScript.arguments.count <> 1 Then
WScript.Echo "Usage: SetComputerPass.vbs <ComputerDN>"
WScript.Quit
End If
strDn = WScript.arguments.item(0)
Set objPassword = CreateObject("ScriptPW.Password")
WScript.StdOut.Write "Password:"
strPassword = objPassword.GetPassword()
Set objComputer = GetObject("LDAP://" & strDn)
objComputer.SetPassword strPassword
WScript.Quit
>
> On 05/06/2014 10:51:36 PM authen wrote:
For NTLMv2 to work, a computer account on which you run NTLMv2 service is required for security reason. This is due to the fact that NTLM is a man-in-the-middle authentication service which relies on Domain Controller (DC) to authenticate the incoming client. In order for NTLM to be capable of acting as the middle man to be trusted by client, NTLM should authenticated itself to DC first and thereafter a computer/service account is required since version 2.
Open Active Directory Users and Computers console
Right click on "CN=Computers" under DC=<domain>
Choose 'New' and then click on 'Computer'
Follow the wizard to finish.
Note: If your physical computer belongs to an AD domain, the domain controller should have already generated a computer account which can be found under "CN=Computers, DC=<domain>" in AD. This physical computer account can be used as NTLMv2 service account of course.
References:
|
|
|
|
