# Windows - Local Account Protection policy is configured and assigned
Without a properly configured and assigned Local Users and Groups policy in Intune, threat actors can exploit unmanaged or misconfigured local accounts on…
Source: https://maester.dev/docs/tests/ZTA.24564
## Overview
Without a properly configured and assigned Local Users and Groups policy in Intune, threat actors can exploit unmanaged or misconfigured local accounts on Windows devices. This can lead to unauthorized privilege escalation, persistence, and lateral movement within the environment. If local administrator accounts aren't controlled, attackers can create hidden accounts or elevate privileges, bypassing compliance and security controls. This gap increases the risk of data exfiltration, ransomware deployment, and regulatory noncompliance.
Ensuring that Local Users and Groups policies are enforced on managed Windows devices, by using account protection profiles, is critical to maintaining a secure and compliant device fleet.
## Remediation
Configure and deploy a **Local user group membership** profile from Intune account protection policy to restrict and manage local account usage on Windows devices:
- Create an [Account protection policy for endpoint security in Intune](https://learn.microsoft.com/intune/device-configuration/endpoint-security/account-protection?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#account-protection-profiles)
- [Assign policies in Intune](https://learn.microsoft.com/intune/device-configuration/assign-device-profile?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#assign-a-policy-to-users-or-groups)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | High |
| Impact on users | Low |
| Pillar | Devices |
| Category | Device management |
| Product | [Intune](/docs/tests/products/intune) |
| Feature | Endpoint security |
| Area | Privileged access |
| ATT&CK | [T1078.003](/docs/tests?mitre=T1078.003) Local Accounts, [T1136.001](/docs/tests?mitre=T1136.001) Local Account |
| Licence | Intune |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.