Windows local admin accounts workflow

A workflow for Password Safe

The built-in local administrator account exists on every Windows server, and it's often shared across many machines with a password that never changes. If an attacker compromises that password, they can move across your network with administrative rights. This workflow brings that account under Password Safe management so its password is unique per server, rotated on a schedule, and only released through an approved, audited request.

Scope of this guide

This workflow shows you how to bring the local administrator account on Windows servers under Password Safe management. You set up Smart Groups to discover Windows servers, rotate their local administrator accounts automatically, and grant a user group auto-approved RDP session access.

Prerequisites

You have administrator access to the BeyondInsight console.
You understand managed systems, managed accounts, Smart Rules, Smart Groups, and role-based access in Password Safe.
A directory credential with privileges to query Active Directory or LDAP is available for discovery scans. Create this credential under Configuration > Discovery and Vulnerability Management > Credentials.
A functional account is available for the Windows servers you plan to bring under management. Password Safe uses this account to manage and rotate the local administrator account.
An access policy is configured to allow auto-approved RDP sessions.

Steps

Step 1: Discover Windows servers

From the left menu in the BeyondInsight console, select Smart Rules.
Select Create Smart Rule.
Select the Category, and enter a meaningful Name and Description for the Smart Rule.
Set Selection Criteria to Directory Query, Include assets from query, with Use to discover new assets during scans enabled. Enter the interval, in hours, to rerun the query so new servers that join the domain are captured automatically.
Set Actions to Show asset as Smart Group and View assets in a standard asset grid.
Select Create Smart Rule.
Run a discovery scan against the Smart Group to pull local account and service details for each asset into BeyondInsight. From the Smart Rules page, select the vertical ellipsis menu for the Smart Group, and start the scan with a credential that has sufficient privileges.

You can also schedule a recurring scan to discover new assets and confirm that local accounts and services haven't changed on existing assets. This keeps the onboarding process dynamic.

Step 2: Bring Windows servers into Password Safe management

From the left menu in the BeyondInsight console, select Smart Rules.
Select Create Smart Rule.
Select the Category, and enter a meaningful Name and Description for the Smart Rule.
Set Selection Criteria to Operating System, contains, windows, and Asset fields, Domain Name, contains, domain.

The Operating System criteria queries servers that share the same functional account. The action associates that functional account with the system.
Set Actions to Show asset as Smart Group, View assets in a standard asset grid, and Manage Assets using Password Safe with Platform: Windows, Account Name Format: Domain\Username, and the functional account from the prerequisites.
Select Create Smart Rule.

To make sure new servers are added to Password Safe management automatically, reprocess this Smart Group regularly, especially after each scan completes.

Step 3: Grant system access to user groups

Creating this managed system Smart Group isn't always required, but it helps you group systems that share managed accounts and assign asset-level permissions to user groups. As assets are added to Password Safe management, they populate automatically within the All Managed Systems Smart Group. This Smart Group specifically targets all Windows servers managed by Password Safe.

From the left menu in the BeyondInsight console, select Smart Rules.
Select Managed System from the Smart Rule Type filter list.
Select Create Smart Rule.
Select Managed Systems from the Category list.
Enter a meaningful Name and Description for the Smart Rule.
Set Selection Criteria to Platforms, Windows.
Set Actions to Show managed system as Smart Group.
Select Create Smart Rule.

Step 4: Add local admin accounts to Password Safe management

The initial creation of this Smart Group includes only the built-in Administrator account name. After you research and review reports, you can add other privileged account names to this Smart Group.

From the left menu in the BeyondInsight console, select Smart Rules.
Select Managed Account from the Smart Rule Type filter list.
Select Create Smart Rule.
Select Managed Accounts from the Category list.
Enter a meaningful Name and Description for the Smart Rule.
Set Selection Criteria to User Account Attribute, Account Name, equals, Discover Accounts for Password Safe Management: yes, and the assets to discover accounts from.
Set Actions to Show managed account as Smart Group and Manage Account Settings with a Password Rule, Enable Automatic Password Management: yes, a Change Password Time, and a Change Password Frequency.

The Manage Account Settings action onboards the specific account, if it's found in the system's scan results. This action also controls whether the account is rotated immediately.
Select Create Smart Rule.

Step 5: Assign user group permissions and roles for account access

Associate a user group with the Smart Group you created in Step 4, then assign permissions, a role, and an access policy to the Smart Group. In this workflow, Password Safe users are Requestors with an access policy that allows auto-approved RDP sessions.

From the left navigation in the BeyondInsight console, select Configuration.
Under Role Based Access, select User Management.
Locate the user group in the grid, and select the More Options (ellipsis) button for that group.
Select View Group Details.
From the Group Details pane, select Smart Groups.
In the Smart Groups Permissions grid, select the Smart Group you created in Step 4, then select Assign Permissions above the grid.
Select Assign Permissions Read Only.
Select the vertical ellipsis button for the Smart Group, then select Edit Password Safe Roles.
Select the Requestor role, then select the Access Policy.
Select Save Roles.

Verify the results

Confirm that the Windows servers appear under Managed Systems and that their local administrator accounts appear under Managed Accounts with automatic password rotation enabled. Verify that the assigned user group can request an auto-approved RDP session to one of the managed servers.

Next steps

Add Local Root Accounts for Linux Servers: Apply the same discovery and management pattern to Linux servers.
Add Local Admin Accounts for Network Devices: Extend local account management to network devices.
Define Just-in-time access policies: Tighten access further with time-limited approvals.

Updated about 2 hours ago