I’ve got a bunch of older SOE machines that still had the local Administrator account enabled. As part of implementing Microsoft LAPS, I wanted to disable that account, and use a newly-created ‘LocalAdmin’ account with LAPS.
The account is created with a randomly-generated GUID as the password. The account’s password is going to come under the management of LAPS anyway. Additionally, it would be a terrible idea to hard-code a password into a script that’s stored in Sysvol.
If an account with that name already exists, the script will quit. Some basic events are also logged to the Event Log to indicate what happened.
My first revision of the script used ADSI to create the account and add it to the Administrators group, but I found that my mileage varied with that method. Some computers had the account created, but it wasn’t a member of Administrators.
It’s now set up to use plain “NET USER” and “NET LOCALGROUP” commands. This is an example of what would be executed:
This script is designed to be set up as a computer Startup Script: