Local admin account does not work anymore on domain joined client computer

Computer Hardware & Server Infrastructure Builds
1

Hello, I need help. I have a windows server 2016 DC with about 24 users currently, all connecting with their domain joined laptops. Everything has worked fine until about a month ago.

When a user has an issue that requires elevated access to resolve, I usually just use the local admin account on the system. About a month ago, I tried the same way and the password kept getting denied. Even when I tried to reset the password using the “forgot password” option provided by windows, after answering all the security questions and entering a new password, I would get a failed error message.

I eventually had to reset it using one of the tools on Hiren’s BootCD. I thought it was a one of situation, but I have just realized 9 of the computers have the same issue. None of the local admin account passwords work for any of the computers. All the computers use Windows 10 Pro for Workstation.

Does anyone have any idea what could be wrong?

PS: Testing the other computers to see if they are affected too.

2

Having a blanket admin account on every PC is a high security risk and you should be setting up LAPS in GPO to handle your local admin accounts.

1 Like
3

Apparently, the May 2023 update of Windows 10 came with a native LAPs client.

A LAPS GPO that I had abandoned(cos it wasn’t working at the time), got triggered and changed the passwords.
Used Get-LapsADPassword -Identity "computername" -AsPlainText to show the active password.