Category filter
Rotate local admin password for Windows
The Rotate Local Admin Password remote action works in conjunction with the Hexnode LAPS policy to immediately change the local administrator password on a Windows device. If the current password is exposed, shared, or needs urgent updating, the IT admin can trigger this action without waiting for the next scheduled rotation defined in the policy. When executed, the password is changed immediately, and the rotation schedule is reset. The updated password can be retrieved securely by the admin through the Hexnode console. The device will use this new password for login, and futher automatic rotations will continue according to the schedule set in the Hexnode LAPS policy.
The Hexnode LAPS policy must be associated with the device for this remote action to be enabled and available for use.
How to rotate a local admin password?
To rotate the local admin password for Windows devices,
- Log in to the Hexnode UEM console.
- Go to Manage > Devices.
- Select the Windows device for which you want to rotate the local admin password.
- On the Device Details page, click Actions > Security > Rotate Local Admin password.
- In the dialog box, click Rotate to immediately generate a new secure password for the admin account(s) specified in the Hexnode LAPS policy.
If the device is offline or unreachable, the password will rotate automatically once it reconnects with the Hexnode UEM server.
Where to find the updated password after a Rotate Local Admin password remote action is executed?
- Go to the Device Details page of the Windows device and open Local Accounts > LAPS.
- Find the desired admin account in the list and click the password reveal icon in the Password column to view the current password.
How does the rotation schedule reset after the Rotate Local Admin password remote action is executed?
When the Rotate Local Admin password action is executed, the password changes immediately, and the rotation schedule resets. For example, in the Hexnode LAPS policy, the automatic rotation may be set to rotate passwords every 2 days. If the remote action is initiated the day after the policy is applied, the next automatic rotation will trigger after 2 days.
How does the Rotate Local Admin password remote action differ from the Hexnode LAPS policy?
The Rotate Local Admin password remote action differs from the Hexnode LAPS policy in how and when passwords are changed:
The Hexnode LAPS policy sets up and manages all aspects of local admin passwords, including which accounts to manage, password complexity, length, retention, and automatic rotation schedule (from 1 to 365 days). Passwords rotate automatically according to this schedule.
The Rotate Local Admin password remote action allows IT admins to immediately rotate the local admin password on a device. It requires the Hexnode LAPS policy to be associated with the device. When executed, it rotates the password right away using the settings defined in the policy.
