--- title: Microsoft Tools for Securing and Managing Privileged Accounts, Part 1 description: In a previous post, we discussed how to protect privileged accounts using robust identity management and authentication mechanisms to control access to company resources on a more granular level. image: https://info.adaptivedge.com/hubfs/Images/AdaptEdge-PAW.png --- Call us Today! (866) 846-7123 [![AdaptivEdge](https://info.adaptivedge.com/hs-fs/hubfs/adaptivedge.png?width=249&height=50&name=adaptivedge.png "AdaptivEdge")](http://adaptivedge.com/) - [Expertise](http://adaptivedge.com/expertise/) - [Microsoft AI Tools](https://adaptivedge.com/expertise/ai-consulting-services/) - [Azure AI](ttps://adaptivedge.com/expertise/azure-ai-consulting/) - [AI Builder](https://adaptivedge.com/expertise/microsoft-ai-builder-consulting/) - [Syntex](https://adaptivedge.com/expertise/microsoft-syntex-consulting/) - [Copilot](https://adaptivedge.com/expertise/microsoft-copilot-consulting/) - [Power Platform](https://adaptivedge.com/expertise/power-platform-consulting/) - [Power BI](https://adaptivedge.com/expertise/power-bi-consulting-and-implementation-services/) - [Power Apps](https://adaptivedge.com/expertise/power-apps-consulting-and-development/) - [Power Automate](https://adaptivedge.com/expertise/power-automate-consulting-and-development/) - [Power Pages](https://adaptivedge.com/expertise/power-pages-consulting-experts/) - [Defender](https://adaptivedge.com/expertise/microsoft-defender-consulting/) - [Defender for Endpoint](https://adaptivedge.com/expertise/microsoft-defender-consulting/endpoint/) - [Defender for Cloud](https://adaptivedge.com/expertise/microsoft-defender-consulting/cloud/) - [Defender for Identity](https://adaptivedge.com/expertise/microsoft-defender-consulting/identity/) - [Defender for Office 365](https://adaptivedge.com/expertise/microsoft-defender-consulting/office-365/) - [Intune](https://adaptivedge.com/expertise/microsoft-intune/) - [Corporate Device Enrollment](https://adaptivedge.com/expertise/microsoft-intune/corporate-device-enrollment/) - [GPO-to-Intune Migration](https://adaptivedge.com/expertise/microsoft-intune/gpo-to-intune-migration/) - [MAM without Enrollment](https://adaptivedge.com/expertise/microsoft-intune/mam-without-enrollment/) - [Device Compliance](https://adaptivedge.com/expertise/microsoft-intune/device-compliance/) - [Microsoft 365](https://adaptivedge.com/expertise/microsoft-365/) - [Azure](https://adaptivedge.com/expertise/microsoft-azure/) - [SharePoint](https://adaptivedge.com/expertise/sharepoint-online/) - [Teams](https://adaptivedge.com/expertise/microsoft-teams/) - [OneDrive](https://adaptivedge.com/expertise/one-drive-for-business/) - [Entra](https://adaptivedge.com/expertise/entra-consulting/) - [Solutions](http://adaptivedge.com/services/) - [M365 Migrations](https://adaptivedge.com/services/microsoft-365-migration-services/) - [SharePoint On-Prem to Online](https://adaptivedge.com/services/sharepoint-migration-services/) - [Divestitures & Carve-Outs](https://adaptivedge.com/services/it-divestiture-and-carve-out-consulting/) - [Mergers and Acquisitions](https://adaptivedge.com/services/it-merger-and-acquisition-m-a-services/) - [Data Center to Azure](https://adaptivedge.com/services/azure-migration-services/) - [Box & Dropbox to M365](https://adaptivedge.com/services/box-and-dropbox-migrations-to-microsoft-365/) - [Google Workspace to M365](https://adaptivedge.com/services/google-workspace-to-microsoft-migrations/) - [File Server to M365](https://adaptivedge.com/services/migrate-file-server-to-microsoft/) - [Enterprise Collaboration](https://adaptivedge.com/services/enterprise-collaboration-consulting/) - [Information Architecture](https://adaptivedge.com/services/microsoft-information-architecture/) - [Web Conferencing](https://adaptivedge.com/services/audio-video-conferencing-consultants/) - [Intranet, Extranet & Portals](https://adaptivedge.com/services/web-portal-intranet-consulting-services/) - [Records & Document Management](https://adaptivedge.com/services/document-management-consulting/) - [IT Security & Compliance](https://adaptivedge.com/services/it-cybersecurity-compliance-consulting-services/) - [Identity & Access Management](https://adaptivedge.com/services/iam-identity-access-management-services/) - [Endpoint & BYOD Security](https://adaptivedge.com/services/endpoint-protection-services-byod-security/) - [Managed Cloud Backup Services](https://adaptivedge.com/services/managed-cloud-backup-consulting/) - [Data Privacy](https://adaptivedge.com/services/data-privacy-security-protection-consulting/) - [Business Process Automation](https://adaptivedge.com/services/business-process-automation-consulting/) - [vCTO](https://adaptivedge.com/services/vcto/) - [Microsoft Licensing CSP](https://adaptivedge.com/services/microsoft-licensing-csp-partner/) - [Project Management](https://adaptivedge.com/services/project-management/) - [About](http://adaptivedge.com/about/) - [Resources](https://info.adaptivedge.com/resources/) - [Contact](http://adaptivedge.com/contact-us/) - [Schedule a Consultation](https://adaptivedge.com/consultation/) # Microsoft Tools for Securing and Managing Privileged Accounts, Part 1 2018-02-09 14:32:35 Posted by [aeadmin](https://info.adaptivedge.com/blog/author/aeadmin) on Feb 9, 2018, 6:32:35 AM - [Tweet](https://twitter.com/share)   In a previous post, we discussed how to [protect privileged accounts](https://info.adaptivedge.com/blog/2017/12/01/tools-techniques-for-protecting-privileged-accounts) using robust identity management and authentication mechanisms to control access to company resources on a more granular level. We introduced three tools from Microsoft that can keep privileged accounts from being compromised – Microsoft Privileged Access Workstation (PAW), Local Administrator Password Solution (LAPS) and Privileged Access Management (PAM). In this post, we’ll take a deeper dive into PAW and LAPS. ## **Microsoft Privileged Access Workstation** Credential hygiene is the practice of verifying that a privileged account is used only on trusted workstations and servers. Microsoft PAWs enforce credential hygiene by distinguishing between administrative accounts and normal user accounts and controlling how the privileged accounts are accessed and used. Using a suite of Windows security technologies, PAWs create a hardened physical environment that protects privileged accounts from both remote attacks and physical compromise within the network. Active Directory structures and policies are automatically created to protect PAWs and admin accounts. The dedicated PAWs environment restricts the use of privileged accounts to sensitive administrative tasks. PAWs also provide sysadmins with commonly used tools such as Remote Server Administration Tools, Systems Internal Suite and Microsoft System Center consoles. PAWs should be configured to prohibit high-risk activities and block primary entry points for malware and cyberattacks. **For example:** - Block Internet access to prevent Web browsing and the use of email applications - Establish policies to restrict the use of USB media while allowing USB devices such as keyboards and mice - Use a host firewall to block inbound network connections - Segment PAW accounts into a hardened organizational unit - Remove or harden management agents ![AdaptEdge-PAW.png](https://info.adaptivedge.com/hs-fs/hubfs/Images/AdaptEdge-PAW.png?width=640&name=AdaptEdge-PAW.png) Microsoft recommends using a dedicated, PAW-hardened PC for privileged access to minimize the risk that privileged account credentials will be accidentally exposed. To avoid carrying two devices for different workloads, administrators also have the option to run a user PC as a virtual machine (VM) inside the PAW PC. In this scenario, the desktop VM will support routine tasks such as email and web browsing, and the PAW VM will be limited to tasks that require increased security. This approach is less expensive and simpler for the user. ## **Local Administrator Password Solution** LAPS automatically encrypts passwords for transmission to Active Directory, where passwords are centrally stored and protected by Access Control Lists. This allows domain administrators to apply granular security policies. Randomly generated passwords are unique on each domain-joined computer. Because LAPS uses existing Active Directory infrastructure, no other technologies need to be installed and maintained. LAPS is a Group Policy Client Side Extension installed on managed machines. Management tasks are performed using tools delivered with the solution to simplify configuration and administration. LAPS automatically determines if an admin’s password is expired and generates a new password when required. The password and its next expiration time are reported to and stored in Active Directory for added protection. ![AdaptEdge-LAPS.png](https://info.adaptivedge.com/hs-fs/hubfs/Images/AdaptEdge-LAPS.png?width=640&name=AdaptEdge-LAPS.png) Not only does LAPS make password management easier, but it reduces the risk of lateral escalation that can occur when an administrator uses the same credentials on multiple network devices. Privileged account passwords are periodically randomized, which ensures that passwords are successfully updated to Active Directory before they’re used locally. In the next post, we’ll discuss how Microsoft Privileged Access Management helps organizations control privileged access and reduces the risk of stolen privileged account credentials. ***Written and composed by our Senior Managing Partner, Stephen Soper*** Tags: [adaptivedge](https://info.adaptivedge.com/blog/tag/adaptivedge), [PAWS](https://info.adaptivedge.com/blog/tag/paws), [LAPS](https://info.adaptivedge.com/blog/tag/laps), [identity management](https://info.adaptivedge.com/blog/tag/identity-management), [privileged accounts](https://info.adaptivedge.com/blog/tag/privileged-accounts) [![Sign-up for a FREE Azure Workshop!](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/3330897/780db7b3-ba85-4e30-b67c-b8d572e7a2bb.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/3330897/780db7b3-ba85-4e30-b67c-b8d572e7a2bb) ### We're here to help! We'd love to find out more about the projects and initiatives you're working on to exchange ideas and provide some high-level guidance where we can.  We love learning from others as well as sharing some of our experience and lessons learned.  [Let's talk!](http://adaptivedge.com/contact-us/) ### Subscribe to Email Updates ### Recent Posts ### Posts by Tag - [SharePoint (47)](https://info.adaptivedge.com/blog/tag/sharepoint) - [Microsoft (44)](https://info.adaptivedge.com/blog/tag/microsoft) - [Technology (37)](https://info.adaptivedge.com/blog/tag/technology) - [Office 365 (32)](https://info.adaptivedge.com/blog/tag/office-365) - [adaptivedge (27)](https://info.adaptivedge.com/blog/tag/adaptivedge) - [cybersecurity (26)](https://info.adaptivedge.com/blog/tag/cybersecurity) - [microsoft gold partner (20)](https://info.adaptivedge.com/blog/tag/microsoft-gold-partner) - [OneDrive (19)](https://info.adaptivedge.com/blog/tag/onedrive) - [ATS (18)](https://info.adaptivedge.com/blog/tag/ats) - [HRIS (18)](https://info.adaptivedge.com/blog/tag/hris) - [Human Resources (18)](https://info.adaptivedge.com/blog/tag/human-resources) - [Azure (17)](https://info.adaptivedge.com/blog/tag/azure) - [MS Announcement (16)](https://info.adaptivedge.com/blog/tag/ms-announcement) - [Microsoft Entra (15)](https://info.adaptivedge.com/blog/tag/microsoft-entra) - [data loss prevention (14)](https://info.adaptivedge.com/blog/tag/data-loss-prevention) - [microsoft teams (14)](https://info.adaptivedge.com/blog/tag/microsoft-teams) - [DLP (13)](https://info.adaptivedge.com/blog/tag/dlp) - [Office 2013 (12)](https://info.adaptivedge.com/blog/tag/office-2013) - [Purview (12)](https://info.adaptivedge.com/blog/tag/purview) - [bookings (12)](https://info.adaptivedge.com/blog/tag/bookings) - [exchange (12)](https://info.adaptivedge.com/blog/tag/exchange) - [outlook (12)](https://info.adaptivedge.com/blog/tag/outlook) - [Cloud (10)](https://info.adaptivedge.com/blog/tag/cloud) - [Governance (8)](https://info.adaptivedge.com/blog/tag/governance) - [microsoft 365 (8)](https://info.adaptivedge.com/blog/tag/microsoft-365) - [security (8)](https://info.adaptivedge.com/blog/tag/security) - [Enterprise (7)](https://info.adaptivedge.com/blog/tag/enterprise) - [Private Cloud (7)](https://info.adaptivedge.com/blog/tag/private-cloud) - [Onboarding (6)](https://info.adaptivedge.com/blog/tag/onboarding) - [cyberattack (6)](https://info.adaptivedge.com/blog/tag/cyberattack) - [system center (6)](https://info.adaptivedge.com/blog/tag/system-center) - [IoT (5)](https://info.adaptivedge.com/blog/tag/iot) - [Mobile HR (5)](https://info.adaptivedge.com/blog/tag/mobile-hr) - [PowerShell (5)](https://info.adaptivedge.com/blog/tag/powershell) - [Teams (5)](https://info.adaptivedge.com/blog/tag/teams) - [microsoft azure (5)](https://info.adaptivedge.com/blog/tag/microsoft-azure) - [Active Directory (4)](https://info.adaptivedge.com/blog/tag/active-directory) - [Compliance (4)](https://info.adaptivedge.com/blog/tag/compliance) - [Employee Engagement (4)](https://info.adaptivedge.com/blog/tag/employee-engagement) - [Employee Satisfaction (4)](https://info.adaptivedge.com/blog/tag/employee-satisfaction) - [Licensing (4)](https://info.adaptivedge.com/blog/tag/licensing) - [O365 (4)](https://info.adaptivedge.com/blog/tag/o365) - [Secure Score (4)](https://info.adaptivedge.com/blog/tag/secure-score) - [privileged accounts (4)](https://info.adaptivedge.com/blog/tag/privileged-accounts) - [AI (3)](https://info.adaptivedge.com/blog/tag/ai) - [Adaptive Edge (3)](https://info.adaptivedge.com/blog/tag/adaptive-edge) - [Classification (3)](https://info.adaptivedge.com/blog/tag/classification) - [Collaboration (3)](https://info.adaptivedge.com/blog/tag/collaboration) - [Data (3)](https://info.adaptivedge.com/blog/tag/data) - [E5 (3)](https://info.adaptivedge.com/blog/tag/e5) - [Education (3)](https://info.adaptivedge.com/blog/tag/education) - [IaaS (3)](https://info.adaptivedge.com/blog/tag/iaas) - [Labels (3)](https://info.adaptivedge.com/blog/tag/labels) - [PaaS (3)](https://info.adaptivedge.com/blog/tag/paas) - [Power BI (3)](https://info.adaptivedge.com/blog/tag/power-bi) - [Remote Workforce (3)](https://info.adaptivedge.com/blog/tag/remote-workforce) - [SCCM (3)](https://info.adaptivedge.com/blog/tag/sccm) - [SQL (3)](https://info.adaptivedge.com/blog/tag/sql) - [Search (3)](https://info.adaptivedge.com/blog/tag/search) - [Storage (3)](https://info.adaptivedge.com/blog/tag/storage) - [identity management (3)](https://info.adaptivedge.com/blog/tag/identity-management) - [AI & Copilot (2)](https://info.adaptivedge.com/blog/tag/ai-copilot) - [API (2)](https://info.adaptivedge.com/blog/tag/api) - [Autmoation (2)](https://info.adaptivedge.com/blog/tag/autmoation) - [Azure AD (2)](https://info.adaptivedge.com/blog/tag/azure-ad) - [BI (2)](https://info.adaptivedge.com/blog/tag/bi) - [Backup & Recovery (2)](https://info.adaptivedge.com/blog/tag/backup-recovery) - [Copilot Cowork (2)](https://info.adaptivedge.com/blog/tag/copilot-cowork) - [GitHub (2)](https://info.adaptivedge.com/blog/tag/github) - [IT Administration (2)](https://info.adaptivedge.com/blog/tag/it-administration) - [Intune (2)](https://info.adaptivedge.com/blog/tag/intune) - [Microsoft 365 Updates (2)](https://info.adaptivedge.com/blog/tag/microsoft-365-updates) - [Microsoft Dynamics (2)](https://info.adaptivedge.com/blog/tag/microsoft-dynamics) - [Microsoft Graph (2)](https://info.adaptivedge.com/blog/tag/microsoft-graph) - [PAWS (2)](https://info.adaptivedge.com/blog/tag/paws) - [People Analytics (2)](https://info.adaptivedge.com/blog/tag/people-analytics) - [Performance (2)](https://info.adaptivedge.com/blog/tag/performance) - [SKU (2)](https://info.adaptivedge.com/blog/tag/sku) - [Safety (2)](https://info.adaptivedge.com/blog/tag/safety) - [Security & Compliance (2)](https://info.adaptivedge.com/blog/tag/security-compliance) - [Server (2)](https://info.adaptivedge.com/blog/tag/server) - [Windows Defender ATP (2)](https://info.adaptivedge.com/blog/tag/windows-defender-atp) - [Workflow Automation (2)](https://info.adaptivedge.com/blog/tag/workflow-automation) - [Zero Trust (2)](https://info.adaptivedge.com/blog/tag/zero-trust) - [copilot studio (2)](https://info.adaptivedge.com/blog/tag/copilot-studio) - [microsoft ignite (2)](https://info.adaptivedge.com/blog/tag/microsoft-ignite) - [Agentic AI (1)](https://info.adaptivedge.com/blog/tag/agentic-ai) - [Artificial Intelligence (1)](https://info.adaptivedge.com/blog/tag/artificial-intelligence) - [Attack Surface (1)](https://info.adaptivedge.com/blog/tag/attack-surface) - [BYOL (1)](https://info.adaptivedge.com/blog/tag/byol) - [Business (1)](https://info.adaptivedge.com/blog/tag/business) - [Business Requirements (1)](https://info.adaptivedge.com/blog/tag/business-requirements) - [CASB (1)](https://info.adaptivedge.com/blog/tag/casb) - [CRM (1)](https://info.adaptivedge.com/blog/tag/crm) - [Cloud Computing (1)](https://info.adaptivedge.com/blog/tag/cloud-computing) - [Coexistence (1)](https://info.adaptivedge.com/blog/tag/coexistence) - [Customer Relationship Management (1)](https://info.adaptivedge.com/blog/tag/customer-relationship-management) - [DBaaS (1)](https://info.adaptivedge.com/blog/tag/dbaas) - [DMZ (1)](https://info.adaptivedge.com/blog/tag/dmz) - [Datacenter (1)](https://info.adaptivedge.com/blog/tag/datacenter) - [ERP (1)](https://info.adaptivedge.com/blog/tag/erp) - [Enterprise Visual Studio (1)](https://info.adaptivedge.com/blog/tag/enterprise-visual-studio) - [Group Writeback (1)](https://info.adaptivedge.com/blog/tag/group-writeback) - [HRSM (1)](https://info.adaptivedge.com/blog/tag/hrsm) - [Hybrid (1)](https://info.adaptivedge.com/blog/tag/hybrid) - [Infrastructure (1)](https://info.adaptivedge.com/blog/tag/infrastructure) - [LAPS (1)](https://info.adaptivedge.com/blog/tag/laps) - [Millennials (1)](https://info.adaptivedge.com/blog/tag/millennials) - [OMS (1)](https://info.adaptivedge.com/blog/tag/oms) - [OSD (1)](https://info.adaptivedge.com/blog/tag/osd) - [Offboarding (1)](https://info.adaptivedge.com/blog/tag/offboarding) - [Office 365 Groups (1)](https://info.adaptivedge.com/blog/tag/office-365-groups) - [PXE (1)](https://info.adaptivedge.com/blog/tag/pxe) - [Payroll (1)](https://info.adaptivedge.com/blog/tag/payroll) - [Performance Reviews (1)](https://info.adaptivedge.com/blog/tag/performance-reviews) - [Recruiting (1)](https://info.adaptivedge.com/blog/tag/recruiting) - [Requirements Gathering (1)](https://info.adaptivedge.com/blog/tag/requirements-gathering) - [SUP (1)](https://info.adaptivedge.com/blog/tag/sup) - [SaaS (1)](https://info.adaptivedge.com/blog/tag/saas) - [Servers (1)](https://info.adaptivedge.com/blog/tag/servers) - [Skype (1)](https://info.adaptivedge.com/blog/tag/skype) - [Succession Planning (1)](https://info.adaptivedge.com/blog/tag/succession-planning) - [TEM (1)](https://info.adaptivedge.com/blog/tag/tem) - [Training and Development (1)](https://info.adaptivedge.com/blog/tag/training-and-development) - [Travel and Expense (1)](https://info.adaptivedge.com/blog/tag/travel-and-expense) - [UEBA (1)](https://info.adaptivedge.com/blog/tag/ueba) - [Unified Groups (1)](https://info.adaptivedge.com/blog/tag/unified-groups) - [UserVoice (1)](https://info.adaptivedge.com/blog/tag/uservoice) - [VM (1)](https://info.adaptivedge.com/blog/tag/vm) - [Virtualization (1)](https://info.adaptivedge.com/blog/tag/virtualization) - [Windows 10 (1)](https://info.adaptivedge.com/blog/tag/windows-10) - [custom scripts (1)](https://info.adaptivedge.com/blog/tag/custom-scripts) - [digital transformation (1)](https://info.adaptivedge.com/blog/tag/digital-transformation) - [disk utilization (1)](https://info.adaptivedge.com/blog/tag/disk-utilization) - [geotagging (1)](https://info.adaptivedge.com/blog/tag/geotagging) - [identity (1)](https://info.adaptivedge.com/blog/tag/identity) - [identity perimeter (1)](https://info.adaptivedge.com/blog/tag/identity-perimeter) - [mobile workforces (1)](https://info.adaptivedge.com/blog/tag/mobile-workforces) - [orchestrator (1)](https://info.adaptivedge.com/blog/tag/orchestrator) - [phishing (1)](https://info.adaptivedge.com/blog/tag/phishing) - [scom (1)](https://info.adaptivedge.com/blog/tag/scom) - [sharing (1)](https://info.adaptivedge.com/blog/tag/sharing) - [software update (1)](https://info.adaptivedge.com/blog/tag/software-update) - [windows automation (1)](https://info.adaptivedge.com/blog/tag/windows-automation) - [windows server (1)](https://info.adaptivedge.com/blog/tag/windows-server) - [workgroup (1)](https://info.adaptivedge.com/blog/tag/workgroup) see all ### OUR COMPANY As a Microsoft Gold Partner, AdaptivEdge helps customers evaluate various product options from a financial perspective as well as from a business and technical perspective. ### LINKS - [Home](http://adaptivedge.com/) - [Company](http://adaptivedge.com/about/) - [Expertise](http://adaptivedge.com/expertise/) - [Services](http://adaptivedge.com/services/) - [News & Events](http://adaptivedge.com/news-events/) - [Blog](http://adaptivedge.com/blog/) - [Contact](http://adaptivedge.com/contact-us/) ### Latest Posts ### SIGN-UP FOR OUR EMAIL LIST Sign-up below for updates about AdaptivEdge today! ### Footer Newsletter - - - Copyright © 2026. AdaptivEdge, LLC. All rights reserved. Designed by [Bound-by Marketing](http://www.boundbymarketing.com)