1

I wish to be able to automate some PCs I manage. Currently, I use Ansible, but I am not opposed to any other tool.

The goal is to be able to remotely change the password of an individual user account on a Windows 10 machine without the user losing access to their saved credentials in the Credential Manager.

I know that on Windows 10 by design it seems that unless a user themself triggers a command via the CTRL+ALT+DEL Password Change screen, then when the password is changed, the Credentials saved and associated secrets are wiped from existence.

However,I am certain I am not the first user to ever want to change a user's password remotely without wanting to scorched earth their Credential Manager and Secrets.

Googling for a few days every combination of the problem I can think of but can't seem to find a reasonable solution.

  • Would a solution using the "RunAs" command work in an automated way on a headless machine?
  • If not, is there any way to strip the credential wiping functionality from a user account on password change?
2
  • Local accounts or Active Directory accounts? Aug 16, 2022 at 14:57
  • @user1686 Local accounts
    – Jibril
    Aug 16, 2022 at 14:57

3 Answers 3

0

I don't know of a way to avoid credentials being wiped on password change.

As a workaround, you could in Control Panel > Credential Manager use the buttons of "Back up Credentials" and "Restore Credentials" to save and restore the user's credentials after the change.

I suppose Windows Credentials are more important than Web Credentials.

I suggest to test this method on a test computer.

0

As far as I know there are two ways to change the password for a local Windows user.

  1. Supply the user-name, the old password and the new password. This is used on the CTRL+ALT+DEL page. In this case all saved credentials are kept.

  2. Reset the password, using various Windows tools including net user. In this case you just provide the user-name and the new-password, but not the old one. In this case all saved credentials are lost, otherwise any administrator could just change a user's password and then get access to the saved credentials of the user.

So if you want to keep the credentials, you need to know the old password when changing it.

I know there are command line tools that allow you to use the first method. In the end it is just a WIN32 API call

In the past I used passwd.exe by a guy called Alexander Frink, but I'm not sure if it is still available online.

0

Call the NetUserChangePassword() API, e.g. through PyWin32.

If not, is there any way to strip the credential wiping functionality from a user account on password change?

No; the functionality isn't as much "wiping" as it is "losing the decryption key". Although the data may indeed be wiped, it is primarily because each user's DPAPI master key is encrypted using their login password, and all credentials & private keys are encrypted with it. So a password 'change' re-encrypts the DPAPI master key, but a 'reset' is unable to do so (as the old password isn't provided).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .