If a machine gets reinstalled, all you have to do is run that script. You can copy it and point it at a different host list if you only want to do one or two machines. Walter says all this does is copy the encrypted password strings, it doesn't change uids or gids or anything out from underneath you.

This requires that root be able to log in without a password on the machine.

This may also require changing ownership on files in the home directory (see attached script).

When re-installing a machine, one needs to run "accounts-client host=hostname" from cscf.cs first, where hostname is the machine that's being reinstalled. This causes accounts to actually be created on the target machine. After that, the sync-passwords script that's run on plg2 will sync 'em up. This can be run by hand (or cut down to only sync the one machine). It seems to only sync two or three passwords at a time though, so multiple runs may be required. This is probably a bug.