{"id":68803,"date":"2005-10-06T20:38:00","date_gmt":"2005-10-06T20:38:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2005\/10\/06\/how-can-i-verify-that-none-of-my-local-user-accounts-have-a-blank-password\/"},"modified":"2005-10-06T20:38:00","modified_gmt":"2005-10-06T20:38:00","slug":"how-can-i-verify-that-none-of-my-local-user-accounts-have-a-blank-password","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-can-i-verify-that-none-of-my-local-user-accounts-have-a-blank-password\/","title":{"rendered":"How Can I Verify that None of My Local User Accounts have a Blank Password?"},"content":{"rendered":"

\"Hey, \n

Hey, Scripting Guy! How can I verify that none of my local user accounts have a blank password?

— TB<\/P>\"Spacer\"\"Hey,\"Script<\/A> \n

Hey, TB. To begin with, we should point out that at least some of you won\u2019t need to make this check on computers within your domain; that\u2019s because you\u2019re using password policies in the domain that would prohibit the use of a blank password. (For example, you might require passwords to be at least 7 characters long, a policy that prevents anyone from using a blank password.) For organizations who don\u2019t have a password policy (or for workgroups or home computers), however, you can use a script like this to check for blank passwords:<\/P>

On Error Resume Next<\/p>\n
Set objNetwork = CreateObject(“Wscript.Network”)\nstrComputer = objNetwork.ComputerName<\/p>\n
strPassword = “”<\/p>\n
Set colAccounts = GetObject(“WinNT:\/\/” & strComputer)\ncolAccounts.Filter = Array(“user”)<\/p>\n
For Each objUser In colAccounts\n    objUser.ChangePassword strPassword, strPassword\n    If Err = 0 or Err = -2147023569 Then\n        Wscript.Echo objUser.Name & ” is using a blank password.”\n    End If\n    Err.Clear\nNext\n<\/PRE>\n
Admittedly, some of you might be looking at this and thinking, \u201cThat\u2019s a nice little script and all. But how come you didn\u2019t just run some sort of query asking for a list of users who have a blank password?\u201d Well, there\u2019s a good reason for that: there\u2019s no way to run such a query. Even as administrators it\u2019s impossible for us to write a script that retrieves a user\u2019s password; there\u2019s no way to get that information. <\/P>\n
Therefore, we have to be a bit sneaky about this. What we do, instead, is try to change the user\u2019s password using the ChangePassword<\/B> method. ChangePassword requires us to know the user\u2019s current password; in this script, we\u2019ll try using a blank password as the user\u2019s current password. If the script fails, that means the user is not<\/I> using a blank password. If the script succeeds, however, that can only mean one thing: the user is<\/I> using a blank password. In that case, we\u2019ll echo back the name of that user.<\/P>\n
To do this we start out by adding the On Error Resume Next<\/B> statement, creating an instance of the Wscript.Network<\/B> object, and then retrieving the value of the ComputerName<\/B> property; fortuitously enough, ComputerName happens to be the name of the local computer. We set a variable named strPassword to an empty string (\u201c\u201d), then use this line of code to bind to the local computer:<\/P>
Set colAccounts = GetObject(“WinNT:\/\/” & strComputer)\n<\/PRE>\n
Having made the connection, we next apply a Filter<\/B> to ensure that we are working only with user accounts (we don\u2019t want to mess around with printers, services, groups, and other objects that are found in the local Security Accounts Manager):<\/P>
colAccounts.Filter = Array(“user”)\n<\/PRE>\n
Applying a filter leaves us with a collection consisting solely of local user accounts; in turn, we then set up a For Each loop to walk through that collection. For each account in the collection we call the ChangePassword method, passing the variable strPassword as both the first parameter (current password) and the second parameter (the new password):<\/P>
objUser.ChangePassword strPassword, strPassword\n<\/PRE>\n
We then immediately check the value of the Err<\/B> object. If ChangePassword succeeds, then Err will be equal to 0; that means the user has a blank password. Alternatively, Err might be equal to -2147023569; that means the method would<\/I> have succeeded except that, due to local policy, not enough time has elapsed since the last password change. But because the method would have succeeded, we know that the user has a blank password. If either condition is True we echo back the name of the user.<\/P>\n\n<\/THEAD>\n\n\n
\n
Note<\/B>. Yes, technically we also change the password, although we\u2019re simply \u201cchanging\u201d it to a blank password, which is its current value. That means the user is still able to logon with a blank password. If we wanted to, we could make the second parameter passed to ChangePassword something other than an empty string. In that case, running the script would give the user a new<\/I> password (whatever value we used as the second parameter).<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
<\/DIV>\n
We then clear the value of the error object (Err.Clear<\/B>), loop around, and test the next account.<\/P>\n
And yes, you can easily modify this script to work against Active Directory accounts. Here\u2019s a sample script that tests all the accounts in the domain fabrikam.com:<\/P>
On Error Resume Next<\/p>\n
Const ADS_SCOPE_SUBTREE = 2<\/p>\n
strPassword = “”<\/p>\n
Set objConnection = CreateObject(“ADODB.Connection”)\nSet objCommand =   CreateObject(“ADODB.Command”)\nobjConnection.Provider = “ADsDSOObject”\nobjConnection.Open “Active Directory Provider”\nSet objCommand.ActiveConnection = objConnection<\/p>\n
objCommand.Properties(“Page Size”) = 1000\nobjCommand.Properties(“Searchscope”) = ADS_SCOPE_SUBTREE <\/p>\n
objCommand.CommandText = _\n    “SELECT AdsPath FROM ‘LDAP:\/\/dc=fabrikam,dc=com’ WHERE objectCategory=’user'”  \nSet objRecordSet = objCommand.Execute<\/p>\n
objRecordSet.MoveFirst\nDo Until objRecordSet.EOF\n    strPath = objRecordSet.Fields(“AdsPath”).Value\n    Set strUser= GetObject(strPath)\n    strUser.ChangePassword strPassword, strPassword\n    If Err= 0 or Err = -2147023569 Then\n        Wscript.Echo strUser.CN\n    End If\n    Err.Clear\n    objRecordSet.MoveNext\nLoop\n<\/PRE>\n
If you use this script bear in mind that it tries to change the password for all your user accounts. If you have hundreds or thousands of accounts, the script could take an hour, maybe even more, to complete. There\u2019s nothing wrong with that, just something to be aware of. <\/P>\n
And, of course, you can also modify this script to test for other passwords. Want to see if anyone has a password of password<\/I>? Then just set the value of strPassword accordingly:<\/P>
strPassword = “password”\n<\/PRE><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! How can I verify that none of my local user accounts have a blank password?— TB Hey, TB. To begin with, we should point out that at least some of you won\u2019t need to make this check on computers within your domain; that\u2019s because you\u2019re using password policies in the domain that […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,19,3,20,5,718],"class_list":["post-68803","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-activex-data-objects-ado","tag-scripting-guy","tag-user-accounts","tag-vbscript","tag-winnt"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! How can I verify that none of my local user accounts have a blank password?— TB Hey, TB. To begin with, we should point out that at least some of you won\u2019t need to make this check on computers within your domain; that\u2019s because you\u2019re using password policies in the domain that […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/68803","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=68803"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/68803\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=68803"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=68803"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=68803"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}