Create windows user programmatially without hardcoding the password

Question

How to create windows user using some command line tool or windows API or .NET without hard-coding the password, I need a way to create a user with some password without actually knowing this password, (The program knows only its hash for example).

For example:

Any method to create a windows user with a spicific password will be like this:

UsersUtil.CreateUser("username", "SpIcif1c_Passw0rd");

I need an the code to be like this:

UsersUtil.CreateUser("username", "7604905d86ed36b69a657366e5b5c35f");
//"7604905d86ed36b69a657366e5b5c35f" is the hash for SpIcif1c_Passw0rd for example

I need the code of this CreateUser method or something similar!!

Not the downvoter, but there's very little research effort, and kind of unclear what you're asking. What have you tried? Where are you running into problems? stackoverflow.com/questions/384304/… seems like it addresses a lot of how to create an account. — Steven V
– Steven V, Commented Nov 27, 2013 at 16:37
My problem is not with creating the user, my problem us how to create it without hard-coding the password, there is thousands of ways to create a windows user programmatially, but you need to put the password as clear text. — Saw
– Saw, Commented Nov 27, 2013 at 16:39
@IInspectable: all he needs to know is the password hash for whatever algorithm the Windows SAM uses (MD5 IIRC). So there's really no reason in principle why this couldn't be possible, although AFAIK Windows provides no supported way to do it. It's a fair question. — Harry Johnston
– Harry Johnston, Commented Nov 28, 2013 at 7:05

Harry Johnston · Accepted Answer · 2013-11-28 23:26:59Z

1

Unfortunately, there are two problems with this:

To the best of my knowledge Windows doesn't provide any supported mechanism. It might be possible to do this by manipulating the SAM directly, but there's no guarantee that what works today will work tomorrow.
In Windows, the password hash is a password-equivalent, i.e., anyone who knows the hash can (under certain circumstances) access the account as if he or she had the password. So using the hash rather than the password doesn't actually give you the security benefit you're presumably aiming for. (Google "pass the hash" for more information.)

If you post another question describing your scenario, we may be able to suggest alternative approaches, though I'm afraid this is typically an awkward problem to solve. Or, if you prefer, you can email me directly (see my profile for contact details) and I may be able to help.

answered Nov 28, 2013 at 23:26

Harry Johnston

36.7k7 gold badges74 silver badges170 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Saw Over a year ago

All I was trying to do is to solve hardcoded passwords problem in some legacy code, I have found some workarounds.

Collectives™ on Stack Overflow

Create windows user programmatially without hardcoding the password

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related