# Local Admin Password Solution is deployed
Without Local Admin Password Solution (LAPS) deployed, threat actors exploit static local administrator passwords to establish initial access.
Source: https://maester.dev/docs/tests/ZTA.21953
:::note[Maester checks this too]
[CIS.M365.5.1.4.5](/docs/tests/CIS.M365.5.1.4.5) (Ensure Local Administrator Password Solution is enabled) checks the same setting. Running both reports it twice.
:::
## Overview
Without Local Admin Password Solution (LAPS) deployed, threat actors exploit static local administrator passwords to establish initial access. After threat actors compromise a single device with a shared local administrator credential, they can move laterally across the environment and authenticate to other systems sharing the same password. Compromised local administrator access gives threat actors system-level privileges, which lets them accomplish a wide range of malicious activities, including:
- Disable security controls
- Install persistent backdoors
- Exfiltrate sensitive data
- Establish command and control channels
The automated password rotation and centralized management of LAPS closes this security gap and adds controls to help manage who has access to these critical accounts. Without solutions like LAPS, you can't detect or respond to unauthorized use of local administrator accounts, giving threat actors extended dwell time to achieve their objectives while remaining undetected.
## Remediation
- [Configure Windows Local Administrator Password Solution](https://learn.microsoft.com/entra/identity/devices/howto-manage-local-admin-passwords?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Low |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Identity |
| Category | Access control |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Device identity |
| Area | Privileged access |
| ATT&CK | [T1078.003](/docs/tests?mitre=T1078.003) Local Accounts, [T1021](/docs/tests?mitre=T1021) Remote Services |
| Licence | P1 |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.