What does your local administrator password look like?

𝗗𝗲𝗳𝗮𝘂𝗹𝘁 → 𝗛𝗮𝗿𝗱𝗲𝗻𝗲𝗱

Real configs. Real fixes. Windows & AD security.

𝗪𝗵𝗮𝘁 𝗱𝗼𝗲𝘀 𝘆𝗼𝘂𝗿 𝗹𝗼𝗰𝗮𝗹 𝗮𝗱𝗺𝗶𝗻𝗶𝘀𝘁𝗿𝗮𝘁𝗼𝗿 𝗽𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝗹𝗼𝗼𝗸 𝗹𝗶𝗸𝗲?

And is it the same on all Windows servers or workstations?

Because I still see this 𝗮𝗹𝗹 𝘁𝗵𝗲 𝘁𝗶𝗺𝗲.

⚠️ One local admin password for all servers.

⚠️ One local admin password for all workstations.

⚠️ Or even worse – one password for everything.

⚠️ And because admins “need to type it sometimes”, the password is often not even that long or complex.

𝗕𝘂𝘁 𝗵𝗲𝗿𝗲 𝗶𝘀 𝘁𝗵𝗲 𝘁𝗵𝗶𝗻𝗴:

➡️ You don’t really need to know it most of the time. You barely use it.

And no, the solution is not:

🔸 Excel

🔸 Notepad

🔸 sticky notes

🔸 “secure” shared document

🔸 password manager with the same static password everywhere

➡️ No, no and no.

𝗧𝗵𝗲𝗿𝗲 𝗶𝘀 𝗮 𝗺𝘂𝗰𝗵 𝗯𝗲𝘁𝘁𝗲𝗿 𝘀𝗼𝗹𝘂𝘁𝗶𝗼𝗻.

✅ Integrated.

✅ Free.

✅ Designed exactly for this problem.

𝗟𝗼𝗰𝗮𝗹 𝗔𝗱𝗺𝗶𝗻𝗶𝘀𝘁𝗿𝗮𝘁𝗼𝗿 𝗣𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻 – 𝗟𝗔𝗣𝗦

There was the older Microsoft LAPS version, which had to be installed separately. And now there is Windows LAPS, which is 𝗶𝗻𝘁𝗲𝗴𝗿𝗮𝘁𝗲𝗱 into modern Windows versions 𝗮𝗳𝘁𝗲𝗿 the April 2023 updates.

➡️ This is the one I recommend using today.

Once you implement it, you manage local administrator passwords 𝘁𝗵𝗿𝗼𝘂𝗴𝗵 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆. And the important part – passwords are 𝗮𝘂𝘁𝗼𝗺𝗮𝘁𝗶𝗰𝗮𝗹𝗹𝘆 generated, stored, protected, and rotated based on your configuration.

𝗧𝗵𝗮𝘁 𝗶𝘀 𝘁𝗵𝗲 𝗴𝗮𝗺𝗲 𝗰𝗵𝗮𝗻𝗴𝗲𝗿.

🔹 You no longer need one shared local admin password.

🔹 You no longer need to manually track it.

🔹 You no longer need to hope nobody copied it somewhere 5 years ago.

🔹 Each machine can have its own unique local administrator password.

🔹 And when needed, authorized admins can retrieve it.

That’s it. Simple idea. Huge security impact.

I created guides for both the older LAPS and Windows LAPS implementation.

They are available for 𝗳𝗿𝗲𝗲 𝗶𝗻 𝗺𝘆 𝗔𝗰𝗮𝗱𝗲𝗺𝘆.

➡️ So if you still do not use LAPS, please – 𝗿𝗲𝗮𝗹𝗹𝘆 𝗱𝗼 𝗶𝘁.

Do you already use LAPS in your environment?