# Local administrator credentials on macOS are protected during enrollment by macOS LAPS
Without enforcing macOS LAPS policies during Automated Device Enrollment (ADE), threat actors can exploit static or reused local administrator passwords…
Source: https://maester.dev/docs/tests/ZTA.24561
:::note[Maester checks this too]
[MT.1217](/docs/tests/MT.1217) (Ensure macOS LAPS is configured on Automated Device Enrollment profiles.) checks the same setting. Running both reports it twice.
:::
## Overview
Without enforcing macOS LAPS policies during Automated Device Enrollment (ADE), threat actors can exploit static or reused local administrator passwords to escalate privileges, move laterally, and establish persistence. Devices provisioned without randomized credentials are vulnerable to credential harvesting and reuse across multiple endpoints, increasing the risk of domain-wide compromise.
Enforcing macOS LAPS ensures that each device is provisioned with a unique, encrypted local administrator password managed by Intune. This disrupts the attack chain at the credential access and lateral movement stages, significantly reducing the risk of widespread compromise and aligning with Zero Trust principles of least privilege and credential hygiene.
## Remediation
Use Intune to configure macOS ADE profiles that provision a local admin account with a randomized and encrypted password, and that enables secure rotation:
- [Configure macOS LAPS in Microsoft Intune](https://learn.microsoft.com/intune/device-security/laps/setup-macos?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
- [Rotate local admin password (macOS)](https://learn.microsoft.com/intune/device-management/actions/rotate-local-admin-password?pivots=macos&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
For more information, see:
- [macOS ADE setup guide](https://learn.microsoft.com/intune/device-enrollment/apple/setup-automated-macos?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Devices |
| Category | Devices |
| Product | [Intune](/docs/tests/products/intune) |
| Feature | Device enrollment |
| Area | Privileged access |
| ATT&CK | [T1078.003](/docs/tests?mitre=T1078.003) Local Accounts, [T1021](/docs/tests?mitre=T1021) Remote Services, [T1552.001](/docs/tests?mitre=T1552.001) Credentials In Files |
| Licence | Intune |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.