Manage the local administrators on Microsoft Entra joined devices

Overview

When local administrators on Microsoft Entra joined devices aren’t properly managed, threat actors with compromised credentials can execute device takeover attacks by removing organizational administrators and disabling the device’s connection to Microsoft Entra. This lack of control results in complete loss of organizational control, creating orphaned assets that can’t be managed or recovered.

Remediation

• Manage the local administrators on Microsoft Entra joined devices

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Low
Effort to fix	Low
Impact on users	Low
Pillar	Identity
Category	Access control
Product	Entra ID
Feature	Device identity
Area	Privileged access
ATT&CK	T1531 Account Access Removal, T1078.004 Cloud Accounts
Licence	P1
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.