Set-UniquePassword

Function Set-UniquePassword {
<#
.SYNOPSIS
 
    Sets a unique password for a local account on each machine.
    
    Function: Set-UniquePassword
    Author: Chris Campbell (@obscuresec)
    License: BSD 3-Clause
    Required Dependencies: None
    Optional Dependencies: None
    
.PARAMETER ComputerName

    Specifies the computername to run the script against. By default $Env:COMPUTERNAME is used.

.PARAMETER UserName

    Specifies the username of the local account. By default "Administrator" is used.

.PARAMETER Position

    Specifies whether to append or prepend the phrase to the generated token. 

.PARAMETER Phrase

    Specifies the phrase that will be added to the token. Phrases will be static in each password and must contain at least one upper, lower, number and special character and be between 4 and 60 characters long.

.PARAMETER Token

    Specifies the unique attribute of each password. Available options are serial number, mac address and hostname. Hostname is the default option.

.PARAMETER Random

    Switch parameter that generates a random password of a random length (between 30 and 60 characters).

.EXAMPLE

    Get-Content c:\demo\computers | Set-UniquePassword -Random | ConvertTo-Csv | Out-File c:\demo\password_update.csv

.EXAMPLE

    'localhost','test','127.0.0.1' | Set-UniquePassword -Random

.EXAMPLE

    Set-UniquePassword -Random

.EXAMPLE

    Set-UniquePassword -UserName "mspresenters" -Position "Prepend" -Phrase "Recycling*3ftw!" -Token "Serial"

.LINK

    http://www.obscuresec.com/

#>


[CmdletBinding(DefaultParametersetName="Random")]
    Param(
        [Parameter(Position=0,
                   ValueFromPipeline=$True,
                   ValueFromPipelineByPropertyName=$True)]
        [ValidateNotNullOrEmpty()]
        [string]$ComputerName = $env:COMPUTERNAME,

        [Parameter(Position=1)]
        [ValidateNotNullOrEmpty()]
        [string]$UserName = 'Administrator',
          
        [Parameter(ParameterSetName="Token",
                   Position=0)]
        [ValidateSet('Append','Prepend', IgnoreCase = $True)]
        [string]$Position = 'append',

        [Parameter(ParameterSetName="Token",
                   Position=1)]
        [ValidatePattern({^(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[\x21-\x2F\x3A-\x40\x5B-\x60\x7B-\x7F]).{4,60}$})]
        [string]$Phrase,

        [Parameter(ParameterSetName="Token",
                   Position=2)]
        [ValidateSet('Serial','Hostname','Mac', IgnoreCase = $True)]
        [string]$Token = 'Hostname',

        [Parameter(ParameterSetName="Random",
                   Position=0)]
        [switch]$Random
    )

    BEGIN {
    
        #Define helper functions
        Function Get-RandomPassword {
            #random password length should help prevent masking attacks
            $PasswordLength = Get-Random -Maximum 60 -Minimum 30
        
            #Use .net to generate a random password
            [Reflection.Assembly]::LoadWithPartialName("System.Web") | Out-Null
            $GeneratedPassword = [System.Web.Security.Membership]::GeneratePassword($PasswordLength,0)
        
            #check complexity http://technet.microsoft.com/en-us/library/cc786468(v=ws.10).aspx
            $ComplexityTest = $GeneratedPassword -cmatch "^(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[\x21-\x2F\x3A-\x40\x5B-\x60\x7B-\x7F]).{30,60}$"

            if (!($ComplexityTest)) {Get-RandomPassword}
            Return $GeneratedPassword
        }

        Function Set-LocalPassword {
            Param(
                [string]$UserName,
                [string]$Password,
                [string]$ComputerName
            )

            try {
                $ADSI = [ADSI] "WinNT://$ComputerName/$Username,User"
                $ADSI.setpassword($Password)
            }
            
            catch {Write-Error $Error[0]}      
        }
    }

    PROCESS {
    
        $Password = $Null
        
        if (!(Test-Connection -ComputerName $ComputerName -quiet)) {$Status = "Network Connection Failed"}
        
        else {

            switch ($PsCmdlet.ParameterSetName) {

                'Random' {
                    
                    try {
                        $Password = Get-RandomPassword
                        Set-LocalPassword -Username $UserName -Password $Password -ComputerName $ComputerName
                        $Status = "Successful"
                    }

                    catch {$Status = "Password Set Failed"}               
                }
                
                'Token' {
                    
                    switch ($Token) {
                
                        #get the serial number from the registry, for Dell this is the service tag beware others leave it blank
                        'Serial' {$TokenPassword = (Get-WmiObject Win32_Bios -ComputerName $ComputerName).SerialNumber}
                
                        #this is what the tool passgen utilized for uniqueness
                        'Hostname' {$TokenPassword = $ComputerName}

                        #equally as weak as using the hostname, gets the last macaddress of the machine
                        'Mac' {$TokenPassword = (Get-WmiObject Win32_NetworkAdapter -ComputerName $ComputerName).MACAddress[-1]}     
                    }

                    switch ($Position) {

                        'Append' {$Password = $TokenPassword + $Phrase}
                        'Prepend' {$Password = $Phrase + $TokenPassword}
                    }
                
                    try {
                        Set-LocalPassword -Username $UserName -Password $Password -ComputerName $ComputerName
                        $Status = "Successful"
                    }

                    catch {$Status = "Password Set Failed"}          
                }

            }


        }
   
        #Create custom object to store results
        $ObjectProperties = @{ 'ComputerName' = $ComputerName;
                               'UserName' = $UserName;
                               'Password' = $Password;
                               'Status' = $Status}
                
        $ResultsObject = New-Object -TypeName PSObject -Property $ObjectProperties
                
        #Output the results
        Write-Output $ResultsObject      
    }

    END {}

}