Running sysinternals PSPASSWD.exe from local system account

[Lucvdv]

I have to change a common password on a number of machines (W2k and XP)
because it was compromised.

They are installed in groups of two or three at different locations, there
is no domain (workgroup setup).

I had foreseen an auto-update system: daily, the 'primary' machine at each
location wil contact a https server, and if an update is available it will
download and install it. The update installer that is downloaded as an EXE
is started under the local system account on that machine.

To change the passwords on all machines without having to go through
detecting computernames etc., I wanted to use SysInternals' pspasswd.exe:

pspasswd.exe \\* -u user1 -p pass1 user2 pass2

This scans all machines in the local domain or workgroup, logs in to each
one of them in turn with username 'user1' and password 'pass1', and changes
the password of 'user2' to 'pass2'. 'User1' and 'user2' can even be the
same.

This works perfectly, as long as the program is launched from a 'real'
console window. When it is started under the local system account it
enumerates all computers and prints their names to stdout, but it only
changes the 'user2' password on the machine where the program is running.


Example output taken from stdout (blank lines omitted, program is running
on COMPUTERNAME3):

COMPUTERNAME1:
COMPUTERNAME2:
COMPUTERNAME3:
Password for COMPUTERNAME3\user2 successfully changed.

No error messages, apparently it doesn't even try to do anything on the
first two computers, just lists their names.


In a normal cmd window, the output would be something like this:

COMPUTERNAME1:
Password for COMPUTERNAME1\user2 successfully changed.
COMPUTERNAME2:
Error changing password:
The user name could not be found.
COMPUTERNAME3:
Password for COMPUTERNAME3\user2 successfully changed.


I've been trying to "log on" and impersonate user1 in the installer before
starting pspasswd, but it doesn't make any difference.

I tried LOGON32_LOGON_INTERACTIVE, LOGON32_LOGON_NEW_CREDENTIALS,
LOGON32_LOGON_NETWORK, LOGON32_LOGON_NETWORK_CLEARTEXT, all with the same
result: zip.

Does anyone have an idea what the program could be missing that makes it
skip over eveything except the local computer?

 

[Lucvdv]

Does anyone have an idea what the program could be missing that makes it
skip over eveything except the local computer?

I got a bit further, 3 different situations (all running under the local
system account):

-1-
Call LogonUser and impersonate, then use Diagnostics.Process.Start: the new
process can't access the network.
Its stdout and stderr can be captured:
newProc.WaitForExit()
Dim s1 As String = newProc.StandardOutput.ReadToEnd

-2-
Don't call LogonUser and do no impersonation, but specify username and
password in the StartupInfo you're passing to Diagnostics.Process.Start:
the new process can access the network, but you don't get anything back
from its stdout and stderr. .StandardOutput.ReadToEnd returns an empty
string.

-3-
Combine the two: call LogonUser and impersonate, *and* specify the same
username and password in StartupInfo. The process runs and can access the
network as in -2-, but calling .WaitForExit throws an "invalid handle"
exception, so still no stdout / stderr.


I'd like to know when/where the process fails, and a simple exit code isn't
enough because it handles several machines with a result message for each.