能ADSI可以用來設置Windows密碼帳戶需要在首次登錄

Question

變化我有這樣的PowerShell腳本的修改版本：https://social.technet.microsoft.com/Forums/scriptcenter/en-US/355d9293-e324-4f60-8eed-18bcc6d67fc0/adsiwinntcomputeradministratoruser-with-alternate-credentials?forum=ITCG

嘗試與第一登錄要求修改密碼的帳戶（如果它失敗我可以使用ctrl + alt + del提示手動更改密碼，但通常會在圖像上對VM進行測試）。那重要的部分是：

Invoke-Command -ComputerName $ComputerName -Credential $Credential -ErrorVariable e -ArgumentList $ComputerName,$NewPassword,$User -ScriptBlock { 
      Param($ComputerName,$NewPassword,$User) 
      $Account = [ADSI]"WinNT://$ComputerName/$User,user" 
      $Account.PwdLastSet = 0 
      $Account.SetInfo() 
      $Account.SetPassword($NewPassword) 
      $Account.SetInfo() 
      $e 
     } 

當我運行這對於不需要在首次登錄改變它成功完成一筆賬：

> Change-LocalPassword -User 'TestAccount' -Credential $wincred -OldPassword $OP -NewPassword $NP -ComputerName $computerName 
Info::Change-LocalPassword::Changing password from <old> to <new> 
Info::Change-LocalPassword::Service WinRM is already running on Localhost 
Info::Change-LocalPassword::Trusted Hosts Value is: <computer> 
Info::Change-LocalPassword Invoking Command: [adsi]WinNT://<computer>/TestAccount,user 
True 

當帳戶運行，需要先登錄：

Change-LocalPassword -User $Config.win_user -Credential $wincred -OldPassword $Config.winog_passwd -NewPassword $Config.win_passwd -ComputerName $computerName 
Info::Change-LocalPassword::Changing password from <old> to <new> 
Info::Change-LocalPassword::Service WinRM is already running on Localhost 
Info::Change-LocalPassword::Trusted Hosts Value is: <computer> 
Info::Change-LocalPassword Invoking Command: [adsi]WinNT://<computer>/<user>,user 
[computer] Connecting to remote server <computer> failed with the following error message : Access is denied. For more information, see 
the about_Remote_Troubleshooting Help topic. 
    + CategoryInfo   : OpenError: (<computer>:String) [], PSRemotingTransportException 
    + FullyQualifiedErrorId : AccessDenied,PSSessionStateBroken 
-Message Error::Change-LocalPassword::Could not set password for <user> on <computer> [computer] Connecting to remote server <computer> failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic. 
False 

本地管理員帳戶是機器上唯一的帳戶，它沒有加入域。其他人是否遇到過這種情況並確定瞭解決方案

Answer 1

添加一個密碼永不過期userflag：

$Account = [ADSI]"WinNT://$ComputerName/$User,user" 
     $Account.UserFlags = 65536 
     $Account.PwdLastSet = 0 
     $Account.SetInfo() 
     $Account.SetPassword($NewPassword) 
     $Account.SetInfo() 

如果你想添加「用戶不能更改密碼」以及與此替換上述行

：

$Account.UserFlags = 64 + 65536