I totally understand using shared local admin accounts, but if you use the same local admin password and username on multiple devices, you have some major security concerns. Any instance where I'm sharing a local password like that would be very much documented, and every login would be accounted for. The only time anyone would use that account would be when I needed to give an external user admin access for a limited period of time - I can pull the current password out of LAPS UI and set it to expire in a few minutes or hours as needed. I have default local (not domain) Admin enabled on computers, but the password is randomized and rotated regularly by LAPS. if they won't pay for user CALs, you could at least deploy LAPS if you haven't yet. This was the compromise, disable & rename the default account, create a new generic account for our company. I'd pushed for having unique usernames for each tech at each of our clients but that would have required additional CALs and got shot down. This was standard practice at my last place, disable & rename the default admin accounts by GPO. We're using LAPS and the built in admin account, and we are using a SIEM that among many many things, will alert us if anything is trying to brute-force any domain or local account. Also, always work from a normal user account and only elevate to admin when you have to.ĭisable domain admin? You mean the built in administrator account for AD? So disable domain admin and create a new admin account. It makes targeting the admin account be it a local admin or a domain admin very easy. The administrator SID for the default administrator always ends in -500, guest is 501. Therefore, Microsoft leaves the administrator account disabled and expects you to create a new one.

Renaming the account doesn't help, because the SID will stay the same. The built-in administrator account has a specific and well-known security identifier, and some attacks target that particular SID.

Accounts administrator account status