Improved security for local administrator accounts
Administrative rights on company computers can be handy, but they often come with insecure and repetitive passwords. In this blog post, we talk about a solution that helps to improve the security of local administrator accounts: Windows LAPS.
LAPS stands for Local Administrator Password Solution. Almost 10 years ago, Microsoft developed the "LAPS" tool, which automatically and regularly changes local passwords and stores them centrally.
About the author
Patrick Jochmann
Modern Workplace Consultant
About the author
Patrick Jochmann
Modern Workplace Consultant
Improved security for local administrator accounts
Administrative rights on company computers can be handy, but they often come with insecure and repetitive passwords. In this blog post, we talk about a solution that helps to improve the security of local administrator accounts: Windows LAPS.
LAPS stands for Local Administrator Password SolutionAlmost 10 years ago, Microsoft developed the "LAPS" tool, which automatically and regularly changes local passwords and stores them centrally.
What advantages does LAPS offer?
Unique passwords
Each local administrator of a computer has their own cryptic admin password, which prevents the use of default passwords.
Regular rotation
The passwords are changed automatically at predefined intervals.
Limited impact
If a password is compromised, not all systems are directly at risk.
What's new?
Why are we writing about LAPS now? Microsoft recently released the new Windows LAPS the successor to the classic LAPS solution. Windows LAPS now offers various Advantagesthat administrators have been waiting for a long time:
Direct integration
The technology is now integrated directly into the computer's operating system, which means that separate software no longer needs to be rolled out.
Extended configuration options
Windows LAPS offers new functions that optimise the use and security of the solution.
The biggest advantage of Windows LAPS is still the Centralised storage of passwordsbut now new: Also in the Azure AD or Intune. No more dependencies on onPrem systems!
To emphasise the importance of Windows LAPS in practice To illustrate this, let us consider the following scenario:
Imagine an organisation has a considerable number of computers on which local administrator accounts are set up with identical and weak passwords. In the worst-case scenario, the employees also have local administrator rights on their workstation computers due to their duties. One day, an employee's company laptop is stolen or an attacker gains access to the device via malware, for example.
Firstly, the attacker will try to find out the access data of the local administrator. Immediately afterwards, he will try to access other computers in the network with these credentials. It will not be long before the access data works on a computer on which IT administrators may be working or from which important servers are accessed. In technical jargon, this is called "Lateral Movement"This means gaining access to more in-depth systems with initially not so important access data.
If IT were to notice this, you would now be faced with having to manually change the passwords on all devices. And what happens to the systems that are currently inaccessible, e.g. in the home office? This process would be time-consuming, error-prone and could lead to significant operational disruptions.
With Windows LAPS, the scenario would be very different. The Passwords would be unique, they rotate regularly and are more cryptic than the very simple access data that is often used. The centralised storage of passwords in Azure AD and the associated device management via Intune enables the organisation to change the password for the device concerned. to be changed immediately and prevent the attacker from accessing other systems. At the same time, the remaining computers would continue to retain their individual, changing passwords, which is a High security of the environment
This example shows how Windows LAPS can help to minimise potential security risks and limit the damage in the event of a security incident. By implementing LAPS, organisations can improve the management of their local administrator accounts and ensure a higher level of security and control over their IT infrastructure.
Do you have any questions?
If you are not yet familiar with LAPS, have not yet implemented it or would like to find out more about the benefits of the new solution, we will be happy to help you introduce Windows LAPS. Contact us and benefit from increased security with minimum effort.