---
title: "Rotate local administrator passwords"
description: "Have the Outpost agent rotate a local administrator password on a schedule, with every password stored in the credential vault before it is set."
url: "https://support.outpostplatform.com/compliance/local-admin-rotation/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "How to turn on managed local administrator password rotation with the credentials.local_admin.* profile settings. The agent escrows each new password to the Depot vault and sets it only after the Depot confirms it is stored. Windows (built-in admin by RID), Linux (root only, chpasswd), macOS preview (named account, sysadminctl). Reveal and Rotate now in Documentation."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  platforms: ["windows", "linux", "macos"]
  permission: "profile:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/compliance/local-admin-rotation.md"
license: "CC BY 4.0"
---

# Rotate local administrator passwords

Outpost can manage the password of one local administrator account on each
endpoint. The agent generates a new password on a schedule, stores it in your
Outpost credential vault, and sets it on the endpoint only after Outpost
confirms the vault holds it. Technicians then reveal the current password from
the console when they need it, and every reveal is recorded. Use it so that no
two endpoints share a local administrator password and nobody has to remember
one.

## How rotation works

Each rotation follows the same order, so the endpoint never holds a password
Outpost does not have:

1. The agent generates a candidate password from the profile's length and
   character settings.
2. The agent sends the candidate to Outpost, which seals it in the vault.
3. Only after Outpost confirms it is stored does the agent set it on the
   account.
4. The agent reports the result, and the new password becomes the current one.

Outpost keeps every earlier password. If an endpoint restarts in the middle of
a rotation, the agent cannot tell whether the new password was set, so Outpost
keeps both and says so.

## Platform support

| Platform | Account managed | Notes |
| --- | --- | --- |
| Windows | The built-in administrator by default, found by its well-known identifier even if it was renamed, or the account you name. | Can create the named account and add it to the local Administrators group. |
| Linux | `root` only. | Uses `chpasswd`, which must be installed. Outpost never creates an account on Linux. A locked root, a root with password sign-in disabled, or a root with no password reports **Nothing to rotate** and is left unchanged, because setting a password would turn on password sign-in as root. |
| macOS (Preview) | The account you name. macOS has no built-in administrator, so you must name one. | Uses `sysadminctl`. Outpost changes the password as the account itself, authorized by the current password it holds, so the account's secure token and FileVault unlock keep working. It never forces a reset. |
| FreeBSD and OpenBSD | Not supported. | |

On macOS, the rotation needs the account's current password. If Outpost does
not hold it, for example for an account someone created by hand, the rotation
is refused, the password is left unchanged, and the history shows **Outpost
lost track of the value**. Let Outpost create the account instead: name a new
account and turn on `credentials.local_admin.create_if_missing`. Outpost
creates it as an administrator with the full name **Outpost Admin**.

## Before you begin

- You need `profile:manage` to change a profile. To reveal a password you need
  `vault:reveal`, which the Owner, Support Manager, and Field Technician roles
  hold. **Rotate now** needs `vault:rotate`, which the Owner and Support
  Manager roles hold.
- Turning rotation on changes a password someone may be relying on. The first
  rotation is the moment the old password stops working on that endpoint.
- Services and scheduled tasks that run as the managed account are not
  updated when its password changes. Check for them before you turn rotation
  on. The console warns when the endpoint's inventory shows any.

:::caution
Do not manage the same account with Windows LAPS and Outpost. Two tools
rotating one password can leave you without a working one.
:::

## Turn on rotation

1. Select **Profiles** > **All profiles** and open the profile assigned to the
   endpoints you want to manage, or create one. See [Automation](/automation/).
2. Open the **Settings** tab. In **Search settings**, enter
   `credentials.local_admin`.
3. For each setting below that you want to change, select **Set in this
   profile**, enter the value, and select **Save**.

   | Setting | Default | What it does |
   | --- | --- | --- |
   | `credentials.local_admin.enabled` | Off | Turns rotation on. If any applicable profile turns it on, it is on. |
   | `credentials.local_admin.account_name` | Empty | The account to manage. Empty means the built-in administrator on Windows and `root` on Linux. Required on macOS. |
   | `credentials.local_admin.create_if_missing` | Off | Creates the named account as a local administrator when it does not exist. Not used on Linux. If any applicable profile turns it off, it is off. |
   | `credentials.local_admin.rotation_interval_days` | 30 | Days between rotations, from 1 to 365. The shortest interval among applicable profiles applies. |
   | `credentials.local_admin.password_length` | 20 | Characters in each password, from 12 to 64. The longest among applicable profiles applies. |
   | `credentials.local_admin.password_charset` | `lower`, `upper`, `digits`, `symbols` | The character classes a password draws on, with at least one character from each. Only classes every applicable profile allows are used. |
   | `credentials.local_admin.post_rotation_action` | `none` | What to do after a rotation. `none` is the only option. |

4. Make sure the profile is assigned to the endpoints you want to manage, on
   its **Assignments** tab.

The agent starts managing the account once it receives the updated policy,
and rotates the password on the interval after that. Whether a rotation is
overdue is judged by Outpost's clock, not the endpoint's.

:::note
No compliance framework turns rotation on. The CJIS Security Policy sets a
floor of 30 days on `credentials.local_admin.rotation_interval_days`, which
applies only once you turn rotation on.
:::

## Reveal the current password

Managed passwords are stored in the credential vault, in the collection
**Managed local accounts**. Each credential is named after the account, or
**Local administrator** for the built-in account.

1. Select **Documentation** > **Credentials** and open the credential.
2. On **The password** card, select **Reveal**, then **Show it**. If the
   credential asks why, enter a reason first.
3. Copy the password with **Copy**, and select **Hide** when you are done.

Every reveal is recorded in the audit log with your name. The **Rotated by
Outpost** card on the same page lists every rotation, newest first, with its
state, result, and reason.

If the card says **The endpoint restarted while this password was being
changed, so Outpost holds two values and cannot tell which one the account
accepts. Try the newest one first.**, try the newest password, then the one
before it.

## Rotate a password on demand

1. Open the credential under **Documentation** > **Credentials**.
2. On the **Rotated by Outpost** card, select **Rotate now**.
3. Read any warning about services or scheduled tasks that sign in as the
   account, then select **Rotate it**.

The card shows **Outpost asked the endpoint to rotate this password. The
result appears here when the endpoint answers.**

## Verify

On the **Rotated by Outpost** card, the newest row shows the state **In use**
and the result **Set on the endpoint**. Sign in to the endpoint with the
revealed password to confirm it.

## If something goes wrong

| Result shown | Cause | Fix |
| --- | --- | --- |
| **Refused by the password policy** | The endpoint's password policy rejected the generated password. Its own message is shown under the row. | Widen `password_charset` or raise `password_length` to meet the endpoint's policy. Outpost never widens the character set on its own. |
| **The account does not exist** | The named account is missing and `create_if_missing` is off. | Correct `account_name`, or turn on `create_if_missing`. |
| **The agent was not allowed to change it** | The endpoint refused the change. On macOS, Outpost does not hold the account's current password. | On macOS, have Outpost create a new managed account. Otherwise read the message under the row. |
| **Nothing to rotate** | On Linux, root is locked, key-only, or has no password, or a different account was named. On macOS, no account was named. | On Linux this is expected and safe. On macOS, set `account_name`. |
| **Not supported on this operating system** | The endpoint's platform does not support rotation, or on Linux `chpasswd` is not installed. | Install `chpasswd` on Linux. FreeBSD and OpenBSD are not supported. |

## Next steps

- [Disk encryption recovery keys](/compliance/recovery-keys/)
- [Documentation](/documentation/)
- [Audit logs](/depot/audit-log/)