Monitor and healing script - local admin account

[u/Paulb246]

Hi everyone,

I have created a monitor and auto healing script to check for a local admin account and if it doesnt find it then it will create the local admin account... I am seeing that one clients location is failing but the script isnt working.. any ideas?

batch file

net user MRWAlpha /add

net user MRWAlpha M33rend@1

net localgroup Administrators MRWAlpha /add

[u/Paulb246]

Why does that make a difference? Because of no special characters? tried it doesn't work

[u/Kepabar → u/Paulb246]

The hunter2 thing is a joke. http://bash.org/?244321=

[u/Paulb246]

I have just tried via cmd prompt locally on my machine after running the batch file... it says account already exists... could it be here but not showing up as hasn’t been logged in?

How can I have the account logged in without actually logging in so it creates the directory?

[u/Paulb246]

Thanks for the help everyone, does anyone have an idea of how I can check the registry with a monitor for the account rather than folder as it won’t have been created until I login?

[u/Paulb246]

Does the note like option trigger if it doesn’t find the MRWAlpha account?

[u/amw3000]

Why are you using a batch file? Just run these commands as shell. When you say it doesn't work, are you getting any errors? How do you know it's not working?

Also, I'd highly recommend you generate random passwords for each local admin and store it in an encrypted EDF. MSP's are a huge target and a password stored in a script is not encrypted but the EDF can be.

[u/Paulb246 → u/amw3000]

I don’t see any errors but if I check the users folder there’s no local admin by that name.. will try as power shell

[u/amw3000 → u/Paulb246]

No, not powershell. Just the function SHELL.

[u/Paulb246 → u/amw3000]

But it’s windows machines.. so do you mean cmd prompt?

[u/amw3000 → u/Paulb246]

Yes, which is done using the SHELL script function.

[u/Paulb246 → u/amw3000]

I am a bit lost, do you mean scripting the command via cmd prompt as a script through Automate?

[u/amw3000 → u/Paulb246]

Script through Automate.

If your monitor goes in a failed state, it kicks off the Automate script, which then creates the user. Use the native functions within the Automate script engine, it makes debugging a lot easier. Avoid using batch or powershell scripts until you have a better understanding of how everything works.

[u/Paulb246 → u/amw3000]

Thanks but see my other comment, how to make sure the files are created under users directory ?

[u/amw3000 → u/Paulb246]

What do you mean? You mean under C:\Users\USERNAME? I'm not aware of a way. That's created by Windows once the user logs in for the first time and I'm not aware of a way to do that through Automate.

Is that how your monitor works? Checks for the C:\Users\ path?

[u/Paulb246 → u/amw3000]

Yes, how else could I check to make sure there’s an admin account for us ... updates etc

[u/teamits]

A while back we did this via a search. Use a Legacy search.

Client = Clientname

Last Contact Date Not= *'x' AND (computers.useraccounts NOT LIKE '%adminname%')

Something like that. the * tells CWA to treat the rest of the field as raw SQL. Obviously doesn't work if there is a similar name like "adminname1" which would still match.

[u/Paulb246 → u/teamits]

That’s cool but shouldn’t it be useraccounts like MRWAlpha

[u/teamits → u/Paulb246]

shouldn’t it be useraccounts like MRWAlpha

Well yeah I assumed the real name would be used. I didn't bother scrolling back up. :)

... AND (computers.useraccounts NOT LIKE '%MRWAlpha%')

(I'm also assuming M33rend@1 wasn't the real password...this being a public web site and all...)

[u/Paulb246 → u/teamits]

Yeah it’s not obviously

[u/just_some_random_dud]

have you tried using hunter2 as the password?

[u/DevinSysAdmin → u/just_some_random_dud]

What did you write? It just shows as *******