Member Avatar for Ritesh_4

Hello.
I have an issue, where I want to prevent domain users with administrative rights from modifying the password of the local administrator account on their respective computers. Any way of implementing this?

  • 3 Contributors
  • 2 Replies
  • 401 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by sam07

Dani AI

Generated

Short answer: if a domain user truly has local Administrator rights on a PC, that user can change any local account password (and offline tools can reset the SAM), so it is not possible to absolutely stop a local admin from changing the built‑in Administrator password without removing or constraining that privilege. raised the right concern and is correct that local control (and offline reset tools) are a real risk. See Microsoft’s description of the Administrators group. (Administrators group docs). (learn.microsoft.com)

Practical, recommended steps (build from ’s suggestion to remove domain users from local admin): enforce a small, audited set of local administrators via a centrally applied policy (for example, Restricted Groups or the Local Users and Groups management options in Group Policy/MDM), put a tested break‑glass account in place, and pilot changes in an OU before broad rollout. Make sure to log and regularly review local Administrators membership so drift is detected quickly. (Restricted Groups explanation). (learn.microsoft.com)

Where complete prevention is required while still keeping some local admin capabilities, use a managed local‑admin password solution. Modern Windows LAPS centrally rotates and stores per‑machine local admin passwords and includes tamper protection that can reject unexpected manual password changes and log those events; restrict who can read stored passwords with RBAC and audit reads. Deploy the Windows LAPS variant appropriate for the environment (AD or Microsoft Entra/Intune). (Windows LAPS overview; LAPS tamper protection details). (learn.microsoft.com)

Mitigate offline reset tools by enforcing full disk encryption (BitLocker with TPM + appropriate protectors) and secure boot, and keep documented break‑glass procedures and logs for recovery. These measures together move the environment from “impossible to enforce” toward a practical, auditable posture. (BitLocker overview). (learn.microsoft.com)

Recommended Answers

All 2 Replies

Member Avatar for rproffitt

I think this is nearly impossible. I had an IT staffer that wanted to do this and told them it wasn't possible today. Why? Tools like NTPASSWD make resetting the local admin a snap. Yes it got a little harder with the new BIOS (EFI) but not a big hurdle.

All this has us recalling what a PC is. It's a personal computer and not a terminal. If you need to get absolute control you may have to look at thin clients and such.

commented: Thanks for the info +6
Member Avatar for sam07

Hi there, you may try this, You can remove the domain users from local administrator group. To do so, use this
[Computer Configuration\Windows Settings\Security Settings\Restricted Groups]
and you can visit this for more info. . .technet.microsoft.com/en-us/library/cc785631(WS.10).aspx

commented: Check the question again. This won't stop local password changes. +0
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.