SERVER-024 · Script

Generate Policy Based Passwords

Generates a batch of strong random passwords and saves them to a protected file.

What it does

Creates -Count passwords from a cryptographic random source. Each password contains at least one uppercase letter, lowercase letter and digit, plus a symbol unless -NoSymbols is used. Characters that are easy to misread (0 O 1 l I) are left out unless -AllowAmbiguous is used, which helps when reading passwords aloud or printing them for students. Optionally, -Label gives each password a name, for example a list of new accounts or devices. The passwords are saved only to a CSV in the Runbookia Secure folder, which only SYSTEM and Administrators can read. They are never written to the log or the screen. Changes no accounts.

Requirements

Windows PowerShell 5.1. Run as SYSTEM or a local administrator so the Secure folder can be protected.

How to run it

• Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
• Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
• Script type: PowerShell 5.1, 64-bit
• User interaction: none; the script never prompts
• Timeout: 30 minutes for large directories or many servers

Settings

Exit codes

• 0 = Passwords created
• 2 = Script error (see log)

Testing steps

1. Run it on one test OU, test account or test server and check the output and log.
2. Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
3. Roll out to a small group next, then everyone.

Rollback steps

Creates a password file only; no accounts are changed. Delete the file in the Runbookia Secure folder once the passwords are used.

Version and change log