Local administrator passwords on identity assets are protected and managed with Microsoft LAPS

Overview

The Local Administrator Password Solution randomizes the built-in local Administrator password on every domain-joined and Microsoft Entra-joined device, stores each password centrally in Active Directory or Microsoft Entra ID, and rotates it on a defined schedule so that no two devices share the same secret. Without it, organizations typically image every workstation from the same baseline and inherit a single local Administrator password across the fleet. A threat actor who compromises any one of those workstations can extract the local Administrator credential and replay it against every other device that accepts the same password — the classic Pass-the-Hash attack. Once a single jump host or privileged-access workstation falls, the same credential reaches servers that hold directory secrets, and the intrusion escalates from one endpoint to forest-wide credential theft and persistent administrative control. The argument that a uniform local password is acceptable because the accounts are local to each device collapses the moment one device is breached. Microsoft Defender for Identity’s posture engine lists every monitored device that lacks a managed local Administrator password as a Secure Score recommendation, and the documented remediation is to deploy Windows LAPS — the in-box successor to legacy LAPS — to every Windows endpoint and confirm that each device reports a recently rotated managed password.

Remediation

• What is Windows LAPS?
• Get started with Windows LAPS for Active Directory
• Manage Windows LAPS in Microsoft Entra ID
• Microsoft Defender for Identity security posture assessments

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	SecOps
Category	Identity threat protection
Product	Active Directory
Feature	Computers
Area	Privileged access
ATT&CK	T1078.003 Local Accounts, T1550.002 Pass the Hash
Licence	ATA
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.