Question

A financial services company runs 4,000 Windows Server and client machines, split between Entra-joined devices and on-premises Active Directory-joined servers connected via Azure Arc. A recent penetration test revealed that the same built-in local administrator password was reused across hundreds of machines, enabling lateral movement after a single credential was compromised. The security architect must design a solution that automatically rotates and centrally backs up each machine's local administrator password, stores those secrets securely, and works across both the cloud-joined and on-premises domain-joined estate. Which approach should the architect specify?

Accepted Answer

Deploy Windows LAPS, backing up passwords to Microsoft Entra ID for Entra-joined devices and to Active Directory for domain-joined servers, with automatic password rotation policies enforced via Intune and Group Policy

Answer

Configure Azure Key Vault with a scheduled Azure Automation runbook that connects to each machine over WinRM to reset the local administrator password nightly

Answer

Disable all local administrator accounts and require Microsoft Entra Privileged Identity Management activation for any local logon

Answer

Enforce a Defender for Cloud secure score recommendation to apply the same complex local administrator password across all machines and rotate it quarterly through Group Policy Preferences