Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of the service account with matching name and password. I originally planned to generate the password at install time for one of the two systems and network it over to the other one, along with some other ideas, but here are some of the complications handed to us:
- No domain, just a workgroup.
- USB and other external storage media is not permitted
- While each of the systems will be connecting with the other at some point, they should each be able to be fully installed offline from the other.
As a last resort, the administrators may just have to create and know the password themselves, but the customer would prefer that this not be the case, as they've apparently had low-level administrators tamper with such systems for the expedience of their immediate team, which works against the business rules and everything else in place.
Is there any method for creating a good password that the installing administrators cannot know but can be used at install time?