Multiple flags in creating local user account

[DaGbyte]

I have a script that creates a local user account. I'm trying to set 2 flags at one and am having a hard time. When I run it like this, it doesn't set any flags. I've tried adding or, and a fre others, but the syntax is wrong. Any ideas?

As an aside - if the account already exists, is there an easy way to force to update the account with the settings?

 

$ProgVer = "Disable Admin v 1.00"

;Set variables
$wShell = ObjCreate( "WScript.Shell" )
$sComputerName = @ComputerName
Const $ADS_UF_PASSWD_CANT_CHANGE = 0X40
Const $ADS_UF_DONT_EXPIRE_PASSWD = 0X10000

;Disable Guest account
$oUser = ObjGet("WinNT://" & $sComputerName & "/Guest")
$oUser.AccountDisabled=True
$oUser.SetInfo

;Disable Administrator account
$oUser = ObjGet("WinNT://" & $sComputerName & "/Administrator")
$oUser.AccountDisabled=True
$oUser.SetInfo

; Check if account exists .. if not create it
$oUser = ObjGet("WinNT://" & $sComputerName & "/PCAdmin")
If @Error then
    $colAccounts = ObjGet("WinNT://" & $sComputerName & "")
    $oUser = $colAccounts.Create("user", "PCadmin")
    $oUser.SetPassword ("password")
    $oUser.Put ("Fullname", "PCadmin")
    $oUser.Put ("UserFlags", $ADS_UF_PASSWD_CANT_CHANGE or $ADS_UF_DONT_EXPIRE_PASSWD)
    $oUser.SetInfo
EndIf

;Add PCAdmin into admin group
$oGroup = ObjGet("WinNT://" & $sComputerName & "/Administrators,group")
$oUser = ObjGet("WinNT://" & $sComputerName & "/PCAdmin,user")
$oGroup.Add($oUser.ADsPath)

Exit

 

[BrewManNH]

Seems like a lot of code for a 4 line script.

#RequireAdmin
Run('net user PCadmin password /add /fullname:"PCadmin" /expires:never /passwordchg:no') ; create the user account and set the password, don't allow it to be changed by the user
Run('net localgroup administrators PCadmin /add') ; add the account to the administrators group
Run("wmic USERACCOUNT Where Name='PCadmin' SET PasswordExpires=False") ; set the password to never expire.

Whether the account already exists or not, this will make sure it's set correctly. If it already exists, the first Run command will cause a non-fatal error. The quotation marks may need to be tweaked, I haven't tested this from AutoIt, but it's what I use in a batch file to do the same thing.

[jguinch]

Try with this :

$oUser.Put ("UserFlags", $ADS_UF_PASSWD_CANT_CHANGE + $ADS_UF_DONT_EXPIRE_PASSWD)

 

[DaGbyte]

the + worked like a charm, thanks!

@BrewManNH - I was hoping to avoid using external commands or programs. Of course those would work, but since I am passing passwords and usernames, I'd like to minimize the potential, however slight, of passing them to an external object.

It would be helpful if there was a user function I could use instead - maybe there is - I'll check

 

[BrewManNH]

How do you think the Objects are getting the information, magic? Your script isn't secure, so nothing you do will make it any securer, you aren't going to win that battle.

[iamtheky]

If those flags are set on an account with the string 'admin' in the name, you don't care about security.