LAPS Local Admin Renaming

Question

Hi microsotf team

For security obfUSAcation, we renamed our default built-in local administrator account from 'Administrator' to a cUSAtom string like 'LocalAdminCorp' across all our computers. Can Windows LAPS be configured to automatically find and manage this cUSAtom-named local account, or does it only work on the default SID?

Answer 1

Hi Ahmad,Windows LAPS does not rely on the account name string; it identifies and manages the local administrator account by its well-known RID (500) within the Security Identifier (SID). That means even if you rename the built-in “Administrator” account to something custom like “LocalAdminCorp,” LAPS will still recognize and manage it correctly, because the SID remains unchanged. The only requirement is that the account must not be disabled, and the LAPS policy must be applied to the machine. If you’ve created a separate local account instead of renaming the built-in one, LAPS will not manage that new account, since it only targets the built-in administrator tied to RID 500.

So in your case, with a renamed default administrator, you’re fully supported. If you want LAPS to manage additional custom accounts beyond the built-in one, that is not currently possible; you would need to rely on other credential management solutions for those.

Harry.