When many machines share one local administrator password, stealing it from one device unlocks all of them. That turns a single compromised laptop into lateral movement across the fleet. The fix is a unique, regularly rotated password per device, stored centrally and retrievable only by authorized people.
Why does a shared password spread an intrusion?
Local accounts exist on each machine, separate from your directory. Imaging tools and old habits often set the same built-in administrator password everywhere, because it is convenient for support.
Microsoft's Windows LAPS documentation states the problem plainly: local administrator accounts often share the same password across many devices, which bad actors can exploit to move laterally across the environment. MITRE ATT&CK records the same pattern under technique T1078.003, Valid Accounts: Local Accounts. It notes that password reuse may allow abuse of local accounts across a set of machines for privilege escalation and lateral movement, and that local accounts can be used for initial access, persistence, privilege escalation or defense evasion.
The attacker does not need an exploit for the second machine. They need the password they already have.
What does the fix look like?
Windows LAPS, built into supported Windows versions, automatically manages and backs up the password of a local administrator account on Microsoft Entra-joined or Windows Server Active Directory-joined devices. It rotates each device's password regularly, stores it securely, and lets authorized administrators retrieve it to sign in or recover a device. It can also manage the Directory Services Restore Mode account password on domain controllers.
Two details from Microsoft's overview are worth noting. Windows LAPS differs from the legacy Microsoft LAPS product, so check which one you run. And it is available only on supported platforms, so a machine on an unsupported Windows version needs a different answer, ideally an upgrade.
A constructed example
A company of 400 laptops was imaged years ago with the same local administrator password, known to six support staff and written in an old runbook. A contractor's laptop is infected. The malware dumps cached credentials, finds the local administrator hash and tries it against other machines on the network. Every machine imaged from that template accepts it. Within an hour the attacker is administrator on dozens of hosts, including one used by finance.
With per-device rotation, the dumped credential works on exactly one machine, and by the next rotation it works on none.
How to check or apply this
- Find out which devices share a local administrator password. Test a known-safe credential change on a pilot group or compare password age and hashes using your endpoint management tooling.
- Enable per-device password management for local administrator accounts, using Windows LAPS where your platform supports it.
- Set a rotation period and rotate after any use, so a retrieved password does not stay valid.
- Restrict who can read the stored passwords, and log every retrieval.
- Disable or rename accounts you do not need, and remove local administrator rights from daily-use accounts.
- Remove the old password from runbooks, scripts and images. Treat any place it was written as exposed.
- Add a detection for logins by local accounts across multiple machines in a short window.
What about the people side?
Technology only holds if habits change. Support staff used the shared password because it let them fix any machine quickly, so a replacement has to be at least as fast. Retrieval from a central store takes seconds when it is set up well, and the audit trail it leaves protects the support team too, since every access is attributable.
Plan the rollout in rings: a pilot group of IT's own machines, then one department, then the rest. Watch for scripts and scheduled tasks that embed the old password, since they will break the day it rotates. Searching your repositories and deployment tooling for the old value before you start saves a bad morning.
Quick check
Is a long shared password safe enough?
No. Length does not help when the same secret is valid on every machine. One extraction from memory, a cached credential or a runbook exposes all of them.
Who should be able to retrieve a managed local admin password?
Only named administrators or groups who need it, with every retrieval logged and the password rotated after use.
Sources
- Microsoft Learn: Windows LAPS overview, fetched 18 October 2026.
- MITRE ATT&CK T1078.003, Valid Accounts: Local Accounts.
Last reviewed: 18 October 2026.
