Rotate local administrator passwords

Outpost can manage the password of one local administrator account on each endpoint. The agent generates a new password on a schedule, stores it in your Outpost credential vault, and sets it on the endpoint only after Outpost confirms the vault holds it. Technicians then reveal the current password from the console when they need it, and every reveal is recorded. Use it so that no two endpoints share a local administrator password and nobody has to remember one.

How rotation works

Each rotation follows the same order, so the endpoint never holds a password Outpost does not have:

1. The agent generates a candidate password from the profile’s length and character settings.
2. The agent sends the candidate to Outpost, which seals it in the vault.
3. Only after Outpost confirms it is stored does the agent set it on the account.
4. The agent reports the result, and the new password becomes the current one.

Outpost keeps every earlier password. If an endpoint restarts in the middle of a rotation, the agent cannot tell whether the new password was set, so Outpost keeps both and says so.

Platform support

Platform	Account managed	Notes
Windows	The built-in administrator by default, found by its well-known identifier even if it was renamed, or the account you name.	Can create the named account and add it to the local Administrators group.
Linux	root only.	Uses chpasswd, which must be installed. Outpost never creates an account on Linux. A locked root, a root with password sign-in disabled, or a root with no password reports Nothing to rotate and is left unchanged, because setting a password would turn on password sign-in as root.
macOS (Preview)	The account you name. macOS has no built-in administrator, so you must name one.	Uses sysadminctl. Outpost changes the password as the account itself, authorized by the current password it holds, so the account’s secure token and FileVault unlock keep working. It never forces a reset.
FreeBSD and OpenBSD	Not supported.

On macOS, the rotation needs the account’s current password. If Outpost does not hold it, for example for an account someone created by hand, the rotation is refused, the password is left unchanged, and the history shows Outpost lost track of the value. Let Outpost create the account instead: name a new account and turn on credentials.local_admin.create_if_missing. Outpost creates it as an administrator with the full name Outpost Admin.

Before you begin

• You need profile:manage to change a profile. To reveal a password you need vault:reveal, which the Owner, Support Manager, and Field Technician roles hold. Rotate now needs vault:rotate, which the Owner and Support Manager roles hold.
• Turning rotation on changes a password someone may be relying on. The first rotation is the moment the old password stops working on that endpoint.
• Services and scheduled tasks that run as the managed account are not updated when its password changes. Check for them before you turn rotation on. The console warns when the endpoint’s inventory shows any.

Caution

Do not manage the same account with Windows LAPS and Outpost. Two tools rotating one password can leave you without a working one.

Turn on rotation

1. Select Profiles > All profiles and open the profile assigned to the endpoints you want to manage, or create one. See Automation.

2. Open the Settings tab. In Search settings, enter credentials.local_admin.

3. For each setting below that you want to change, select Set in this profile, enter the value, and select Save.

   Setting	Default	What it does
   credentials.local_admin.enabled	Off	Turns rotation on. If any applicable profile turns it on, it is on.
   credentials.local_admin.account_name	Empty	The account to manage. Empty means the built-in administrator on Windows and root on Linux. Required on macOS.
   credentials.local_admin.create_if_missing	Off	Creates the named account as a local administrator when it does not exist. Not used on Linux. If any applicable profile turns it off, it is off.
   credentials.local_admin.rotation_interval_days	30	Days between rotations, from 1 to 365. The shortest interval among applicable profiles applies.
   credentials.local_admin.password_length	20	Characters in each password, from 12 to 64. The longest among applicable profiles applies.
   credentials.local_admin.password_charset	lower, upper, digits, symbols	The character classes a password draws on, with at least one character from each. Only classes every applicable profile allows are used.
   credentials.local_admin.post_rotation_action	none	What to do after a rotation. none is the only option.

4. Make sure the profile is assigned to the endpoints you want to manage, on its Assignments tab.

The agent starts managing the account once it receives the updated policy, and rotates the password on the interval after that. Whether a rotation is overdue is judged by Outpost’s clock, not the endpoint’s.

Note

No compliance framework turns rotation on. The CJIS Security Policy sets a floor of 30 days on credentials.local_admin.rotation_interval_days, which applies only once you turn rotation on.

Reveal the current password

Managed passwords are stored in the credential vault, in the collection Managed local accounts. Each credential is named after the account, or Local administrator for the built-in account.

1. Select Documentation > Credentials and open the credential.
2. On The password card, select Reveal, then Show it. If the credential asks why, enter a reason first.
3. Copy the password with Copy, and select Hide when you are done.

Every reveal is recorded in the audit log with your name. The Rotated by Outpost card on the same page lists every rotation, newest first, with its state, result, and reason.

If the card says The endpoint restarted while this password was being changed, so Outpost holds two values and cannot tell which one the account accepts. Try the newest one first., try the newest password, then the one before it.

Rotate a password on demand

1. Open the credential under Documentation > Credentials.
2. On the Rotated by Outpost card, select Rotate now.
3. Read any warning about services or scheduled tasks that sign in as the account, then select Rotate it.

The card shows Outpost asked the endpoint to rotate this password. The result appears here when the endpoint answers.

Verify

On the Rotated by Outpost card, the newest row shows the state In use and the result Set on the endpoint. Sign in to the endpoint with the revealed password to confirm it.

If something goes wrong

Result shown	Cause	Fix
Refused by the password policy	The endpoint’s password policy rejected the generated password. Its own message is shown under the row.	Widen password_charset or raise password_length to meet the endpoint’s policy. Outpost never widens the character set on its own.
The account does not exist	The named account is missing and create_if_missing is off.	Correct account_name, or turn on create_if_missing.
The agent was not allowed to change it	The endpoint refused the change. On macOS, Outpost does not hold the account’s current password.	On macOS, have Outpost create a new managed account. Otherwise read the message under the row.
Nothing to rotate	On Linux, root is locked, key-only, or has no password, or a different account was named. On macOS, no account was named.	On Linux this is expected and safe. On macOS, set account_name.
Not supported on this operating system	The endpoint’s platform does not support rotation, or on Linux chpasswd is not installed.	Install chpasswd on Linux. FreeBSD and OpenBSD are not supported.

Next steps

• Disk encryption recovery keys
• Documentation
• Audit logs