> ## Documentation Index
> Fetch the complete documentation index at: https://help.gorelo.io/llms.txt
> Use this file to discover all available pages before exploring further.

# 輪替本機管理員密碼

> 使用 PowerShell 指令稿在 Gorelo 中自動輪替本機管理員密碼，可建立帳戶、設定安全密碼並儲存到自訂欄位。

本指南協助你在 Gorelo 中設定自動本機管理員密碼輪替。該指令稿會建立本機管理員帳戶（若不存在）、將其加入 local administrators 群組、設定安全的隨機密碼，並將該密碼儲存到 Gorelo 以便輕鬆取得。

<Steps>
  <Step title="建立自訂資產欄位。">
    1. 前往 **Settings** > **Assets** > **[Custom Fields](https://app.gorelo.io/admin/admin-settings#asset#assetcustomfields)。**
    2. 新增自訂欄位，內容如下：
       * **Name**：Local Admin Password
       * **Variable**：localadminpassword
       * **Type**：Text
       * 開啟 **Show on Asset Detail** 與 **Blue value**。
    3. 點擊 **Save。**
  </Step>

  <Step title="建立指令稿。">
    1. 前往 **[Scripts](https://app.gorelo.io/asset/script-list)。**
    2. 建立新指令稿，內容如下：
       * **Name**：🔐 Set-LocalAdminPassword
       * **Platform**：Windows
       * **Content**：*\[複製下方提供的 PowerShell 指令稿]*
    3. 點擊 **Save。**

    ```powershell theme={null}
    # =========================================================================
    # Simple Local Admin Password Management Script for Gorelo RMM
    # =========================================================================

    # Configuration variables - change as needed
    $localAdminAccount = "localadmin"
    $accountFullName = "Local Administrator"
    $accountDescription = ""
    $hideFromLogonScreen = $true  # Set to $false to show the account on logon screen

    try {
        # Generate a strong random password
        $CharSet = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_=+[]{}|;:,.<>?"
        $Password = ""
        $Random = New-Object System.Random
        
        # Create a 16-character random password
        1..16 | ForEach-Object { $Password += $CharSet[$Random.Next(0, $CharSet.Length)] }
        
        # Check if the account exists
        $userExists = Get-LocalUser -Name $localAdminAccount -ErrorAction SilentlyContinue
        
        if (-not $userExists) {
            # Create the account if it doesn't exist
            $securePassword = $Password | ConvertTo-SecureString -AsPlainText -Force
            New-LocalUser -Name $localAdminAccount -Password $securePassword -FullName $accountFullName -Description $accountDescription -AccountNeverExpires | Out-Null
            Add-LocalGroupMember -Group "Administrators" -Member $localAdminAccount
            Write-Output "Created local admin account: $localAdminAccount"
        } else {
            # Update password if account exists
            $securePassword = $Password | ConvertTo-SecureString -AsPlainText -Force
            Set-LocalUser -Name $localAdminAccount -Password $securePassword -FullName $accountFullName -Description $accountDescription
            Write-Output "Updated password for: $localAdminAccount"
            
            # Check if user is already in Administrators group, add if not
            $adminGroup = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue
            $isAdmin = $adminGroup | Where-Object { $_.Name -like "*\$localAdminAccount" -or $_.Name -eq $localAdminAccount }
            
            if (-not $isAdmin) {
                Add-LocalGroupMember -Group "Administrators" -Member $localAdminAccount
                Write-Output "Added $localAdminAccount to Administrators group"
            }
        }
        
        # Configure account visibility on logon screen
        if ($hideFromLogonScreen) {
            # Hide the account from logon screen
            $registryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList"
            if (-not (Test-Path $registryPath)) {
                New-Item -Path $registryPath -Force | Out-Null
            }
            Set-ItemProperty -Path $registryPath -Name $localAdminAccount -Value 0 -Type DWORD -Force
            Write-Output "Account hidden from logon screen"
        } else {
            # Show the account on logon screen (by removing the registry entry if it exists)
            $registryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList"
            if (Test-Path $registryPath) {
                if (Get-ItemProperty -Path $registryPath -Name $localAdminAccount -ErrorAction SilentlyContinue) {
                    Remove-ItemProperty -Path $registryPath -Name $localAdminAccount -Force
                }
            }
            Write-Output "Account visible on logon screen"
        }
        
        # Store the password in Gorelo RMM
        GoreloAction -SetCustomField -Name "asset.localadminpassword" -Value $Password
        Write-Output "Password stored in custom field"
        
    } catch {
        # Output error to console for on-demand runs
        Write-Error "Error managing local admin account: $_"
        exit 1
    }
    ```
  </Step>

  <Step title="透過政策部署指令稿。">
    1. 前往 **[Assets](https://app.gorelo.io/asset/asset-list)。**
    2. 選擇任何已執行過指令稿的資產。
    3. 查看 **Custom Fields** 區段以查看儲存的 Local Admin Password。
    4. 需要時點擊揭露圖示以顯示密碼。
  </Step>
</Steps>

## 自訂指令稿

指令稿頂端包含多個可修改的變數：

* `$localAdminAccount` = "localadmin" # 本機管理員帳戶的使用者名稱
* `$accountFullName` = "Local Administrator" # 帳戶的全名
* `$accountDescription` = "" # 帳戶描述（可選）
* `$hideFromLogonScreen` = `$true` # 設為 `$false` 可在登入畫面顯示該帳戶

部署指令稿前，請依組織需求調整這些變數。