Jordan Milne's questions

I often need to log in with a user's domain account to make sure that I've set up their profile correctly, but there's no easy way to do this other than to call them and give them a temp pass and force them to change it (bad, since they often forget it,) or ask for their password (worse.)

Is there any way to change a user's password, then set it back to the original later? I tried to see if there was any way to get the NTLM hash so I could set it back later, but there doesn't seem to be a facility for that built into AD.

We have a number of PCs running XP SP2 (and a couple running SP1) already in production, and we're looking to keep the local administrator's password consistent across the OU. The only solutions I can think of would be using pspassword to change all of their passwords, or having a script containing the password run locally on the PCs.

Unfortunately, pspasswd won't work on computers that aren't online and a local script containing the password would be insecure.

Is there any other viable solution? How can I account for computers that aren't online at the time of the password change?

I'm using an alternative shell (a simple program that restarts a kiosk application if it dies) for a project I'm working on. I've set it via the Shell value in the registry, and I'm not using explorer.exe at all.

However, whenever the windows default file chooser opens, I can just right click on a directory and click open, then explorer will start up, even though I'm not using it as a shell. Is there any way to stop explorer from ever starting up? If I change its name to something like explorer.exe.bak, is there likely to be any negative side-effects?