For changing passwords if you can't allow the local user to be an administrator: You copy SFImpersonator.dll to the system32 directory and register it using regsvr32.exe. Then you can write a VB Script that calls this DLL, impersonate another user on the system (administrator) and change the password. Since the script is encrypted, your Administrator password isn't viewable.
For additional information, see this article.
Support
Documentation
Learning Services
Partner Programs