Local Admin Rights and Privilege Control

Published October 23, 2026 · Last reviewed October 23, 2026

Three layers of privilege

• Everyday user rights. What a person can do while reading mail and browsing. This should be standard-user rights on every computer.
• Local administrator. The built-in account on each computer that can change anything on that machine. Its password must be unique per computer and not shared.
• Organisation-wide administrator. Roles that control the whole tenant or directory, such as Microsoft 365 Global Administrator, Google Workspace super admin, or Domain Admins in a hybrid directory. Few people need these and none should use them for daily work.

Steps, in priority order

Action

List who is an administrator today. On Windows, run net localgroup administrators in a command prompt on a sample of machines. On macOS, run dscl . -read /Groups/admin GroupMembership in Terminal. For the cloud tenant, list the holders of the highest roles in the admin console (Microsoft Entra roles, or the Google Workspace admin roles page).

Why it helps

You cannot reduce rights you have not counted. The list is almost always longer than anyone expected, with former staff, vendor accounts and shared logins on it.

Verification

Record each name and who it belongs to. Any entry nobody can account for is investigated before anything else.

Fallback if delayed

If you cannot run commands, ask your MSP for an export of the administrator groups on all managed computers.

Action

Move staff to standard-user accounts by removing them from the local Administrators group on each machine (through Group Policy, Intune or your management tool, or by hand on a small fleet). Handle exceptions with a short list and a review date. Leave User Account Control on its default prompt level.

Why it helps

Most malware needs administrator rights to do real damage. Taking them away blocks or limits whole classes of attack, and prevents a staff member installing unapproved software.

Verification

Sign in as an ordinary user, try to install a harmless program, and confirm that it prompts for an administrator password. Re-run the listing from step one.

Fallback if delayed

If some software demands administrator rights, grant them to that application’s service account or run it elevated through your management tool, not to the person.

Action

Randomise the local administrator password on every Windows computer. Windows LAPS is built into current Windows and stores a different password for each computer in your directory. Profile A Profile B/C delta: in a hybrid on-premises directory, LAPS can store passwords in Active Directory; in a cloud-only setup, it can store them in Microsoft Entra ID. Without either, use a documented process with a password manager.

Why it helps

If every PC shares one local administrator password, a single stolen password opens them all, and attackers move across the network that way.

Verification

Pick two computers and confirm that their local administrator passwords differ and that only designated IT staff can read them.

Fallback if delayed

Disable the built-in local administrator account where a separate named administrator account exists.

Action

Give each IT person two accounts: a normal one for mail and browsing, and a separate named administrator account used only for admin tasks. Do not use a shared “admin” login. Require MFA on the admin account, and give no one the highest role unless they need it.

Why it helps

If an admin browses or reads mail with an account that holds administrator rights, one phishing message hands the attacker the whole business.

Verification

Review the list of holders of the highest cloud roles. It should show named admin accounts, with no shared mailbox or daily-use account among them.

Fallback if delayed

Where a separate account is impossible, require phishing-resistant MFA on the admin account and review its sign-ins weekly.

Common failure mode

Removing admin rights from staff while leaving a shared local administrator password on every machine, or leaving the IT team signed in all day as Domain Admin or Global Administrator. The first lets one stolen password spread; the second makes any phishing click a full compromise. The other common error is granting “temporary” administrator rights that never expire: put a date next to each exception.

How it works

Malware and intruders run with the rights of the account they take over. A standard user cannot install services, change security settings or read other users’ files, so what the intruder can reach is limited to one person’s data. An administrator can do all of that, and from there often reach other machines.

Attackers then try to move sideways and upward. They look for local administrator passwords reused across machines, for administrator sessions cached on a workstation they have compromised, and for service accounts with excess rights. Unique local passwords break the first; separate admin accounts used only on protected systems limit the second; and a review of accounts with high roles reduces the third. Microsoft’s role guidance and the LAPS documentation, linked below, describe the same pattern. The protection settings that complement this are in endpoint protection hardening.

Worked example

Suppose, as a hypothetical, an office of 35 staff has a shared local administrator password on all laptops and four staff in the local Administrators group. The listing reveals a former contractor’s account on three machines.

The IT lead removes the contractor, deploys LAPS so each laptop has its own password stored in the directory, moves the four staff to standard accounts and keeps a short exception list for one accounting application. A test install on a laptop now prompts for credentials the user does not have. The numbers are invented for illustration. The steps took an afternoon, and no software was purchased.