What are the best methods for rotating local admin passwords on a large fleet of Windows laptops?
Asked by
TechieTurtle42
I've been tasked with rotating the local admin passwords for about 2800 Windows laptops every 15 days due to new security protocols set by our CISO. Each laptop has a single local admin account, and I'm looking for effective ways to manage this password rotation process. What options do I have?
Answers
I do want to mention that while LAPS is a solid solution, some folks find it adds unnecessary complexity. If you want something simpler, consider tools like Admin By Request—it can help control admin access and includes features for password management but at a cost.
Reply to this answer
LAPS is definitely the way to go. It's a reliable tool that not only handles password rotation but is also integrated well with Active Directory. Plus, it's free since it's a Microsoft solution. No additional licensing needed, which is a huge plus!
Reply to this answer
If you're looking for alternatives, I came across a script from the SANS SEC505 course that rotates passwords and encrypts them, saving the details to a file share. It has some nice flexibility, such as scheduling and working on multiple accounts.
Reply to this answer
Consider using Windows LAPS (Local Administrator Password Solution). It's designed exactly for tasks like yours and can work both on-premises and through Intune. Setting it up is pretty straightforward and would automate the process for you.
Reply to this answer
LAPS is truly user-friendly when integrated with Intune. I managed to create a dynamic list in Entra and got it running in no time. I highly recommend it for any fleet of this size.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions