> ## Documentation Index
> Fetch the complete documentation index at: https://help.gorelo.io/llms.txt
> Use this file to discover all available pages before exploring further.

# 轮换本地管理员密码

> 在 Gorelo 中使用 PowerShell 脚本自动化本地管理员密码轮换，该脚本创建账户、设置安全密码并将其存储在自定义字段中。

本指南帮助你在 Gorelo 中设置自动本地管理员密码轮换。该脚本会创建一个本地管理员账户（如果不存在），将其分配到本地管理员组，设置安全的随机密码，并将该密码存储在 Gorelo 中以便轻松检索。

<Steps>
  <Step title="创建自定义资产字段。">
    1. 导航到 **Settings** > **Assets** > **[Custom Fields](https://app.gorelo.io/admin/admin-settings#asset#assetcustomfields)。**
    2. 添加自定义字段，详细信息如下：
       * **Name**：Local Admin Password
       * **Variable**：localadminpassword
       * **Type**：Text
       * 打开 **Show on Asset Detail** 和 **Blue value** 开关。
    3. 点击 **Save。**
  </Step>

  <Step title="创建脚本。">
    1. 导航到 **[Scripts](https://app.gorelo.io/asset/script-list)。**
    2. 创建一个新脚本，详细信息如下：
       * **Name**：🔐 Set-LocalAdminPassword
       * **Platform**：Windows
       * **Content**：*\[复制下面提供的 PowerShell 脚本]*
    3. 点击 **Save。**

    ```powershell theme={null}
    # =========================================================================
    # Simple Local Admin Password Management Script for Gorelo RMM
    # =========================================================================

    # Configuration variables - change as needed
    $localAdminAccount = "localadmin"
    $accountFullName = "Local Administrator"
    $accountDescription = ""
    $hideFromLogonScreen = $true  # Set to $false to show the account on logon screen

    try {
        # Generate a strong random password
        $CharSet = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_=+[]{}|;:,.<>?"
        $Password = ""
        $Random = New-Object System.Random
        
        # Create a 16-character random password
        1..16 | ForEach-Object { $Password += $CharSet[$Random.Next(0, $CharSet.Length)] }
        
        # Check if the account exists
        $userExists = Get-LocalUser -Name $localAdminAccount -ErrorAction SilentlyContinue
        
        if (-not $userExists) {
            # Create the account if it doesn't exist
            $securePassword = $Password | ConvertTo-SecureString -AsPlainText -Force
            New-LocalUser -Name $localAdminAccount -Password $securePassword -FullName $accountFullName -Description $accountDescription -AccountNeverExpires | Out-Null
            Add-LocalGroupMember -Group "Administrators" -Member $localAdminAccount
            Write-Output "Created local admin account: $localAdminAccount"
        } else {
            # Update password if account exists
            $securePassword = $Password | ConvertTo-SecureString -AsPlainText -Force
            Set-LocalUser -Name $localAdminAccount -Password $securePassword -FullName $accountFullName -Description $accountDescription
            Write-Output "Updated password for: $localAdminAccount"
            
            # Check if user is already in Administrators group, add if not
            $adminGroup = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue
            $isAdmin = $adminGroup | Where-Object { $_.Name -like "*\$localAdminAccount" -or $_.Name -eq $localAdminAccount }
            
            if (-not $isAdmin) {
                Add-LocalGroupMember -Group "Administrators" -Member $localAdminAccount
                Write-Output "Added $localAdminAccount to Administrators group"
            }
        }
        
        # Configure account visibility on logon screen
        if ($hideFromLogonScreen) {
            # Hide the account from logon screen
            $registryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList"
            if (-not (Test-Path $registryPath)) {
                New-Item -Path $registryPath -Force | Out-Null
            }
            Set-ItemProperty -Path $registryPath -Name $localAdminAccount -Value 0 -Type DWORD -Force
            Write-Output "Account hidden from logon screen"
        } else {
            # Show the account on logon screen (by removing the registry entry if it exists)
            $registryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList"
            if (Test-Path $registryPath) {
                if (Get-ItemProperty -Path $registryPath -Name $localAdminAccount -ErrorAction SilentlyContinue) {
                    Remove-ItemProperty -Path $registryPath -Name $localAdminAccount -Force
                }
            }
            Write-Output "Account visible on logon screen"
        }
        
        # Store the password in Gorelo RMM
        GoreloAction -SetCustomField -Name "asset.localadminpassword" -Value $Password
        Write-Output "Password stored in custom field"
        
    } catch {
        # Output error to console for on-demand runs
        Write-Error "Error managing local admin account: $_"
        exit 1
    }
    ```
  </Step>

  <Step title="通过策略部署脚本。">
    1. 导航到 **[Assets](https://app.gorelo.io/asset/asset-list)。**
    2. 选择运行了脚本的任何资产。
    3. 查看 **Custom Fields** 部分以查看存储的 Local Admin Password。
    4. 在需要时点击显示图标以显示密码。
  </Step>
</Steps>

## 自定义脚本

该脚本在顶部包含几个你可以修改的变量：

* `$localAdminAccount` = "localadmin" # 本地管理员账户的用户名
* `$accountFullName` = "Local Administrator" # 账户的全名
* `$accountDescription` = "" # 账户描述（可选）
* `$hideFromLogonScreen` = `$true` # 设置为 `$false` 以在登录屏幕显示该账户

在部署脚本之前，请调整这些变量以适合你组织的需求。