Lateral Movement: Why Tiered Admin Accounts and LAPS Matter

Ransomware does not start on the domain controller. It starts on a laptop, with a normal user. The damage happens in the hours that follow, when the attacker moves from that laptop to a server, and from the server to Domain Admin. That movement depends on one thing: finding a credential on the machine they have that works on a machine they want.

Most small business domains make that easy. The same local administrator password on every PC, and a Domain Admin account that logs into workstations to fix printers. Fixing those two habits removes most of the path.

How the attacker moves

Once code runs as a local admin on a workstation, the attacker dumps credentials from memory. Windows caches the password hashes and Kerberos tickets of everyone who has logged in since the last reboot. If a domain administrator remoted in last week to fix something, that hash is there, and a hash is enough to authenticate to other machines. This is pass-the-hash and it needs no password cracking.

If there is nothing useful in memory, the attacker tries the local administrator hash against every other machine on the subnet. When every PC was imaged from the same gold image with the same local admin password, one hash opens all of them. Repeat until a machine with a better credential in memory turns up.

• Tools of the trade are ordinary: PsExec, WMI, WinRM, scheduled tasks, Remote Desktop. None of them are malware; they are administration.
• The domain controller is reached last, and once Domain Admin is in hand the attacker pushes the encryptor by Group Policy or PsExec to everything at once.

LAPS: a different local admin password on every machine

Windows LAPS, built into Windows 10, 11 and Server 2019 and later since 2023, sets a unique random password for the local administrator account on every machine, rotates it on a schedule, and stores it in Active Directory or Entra ID where only authorized staff can read it. The shared gold-image password stops existing, and the hash from one PC opens nothing else.

Deployment is a Group Policy or Intune policy and a schema update for on-premises Active Directory. There is no agent to install on current Windows builds.

1. On-premises: extend the schema with Update-LapsADSchema, then grant computers permission to write their password with Set-LapsADComputerSelfPermission -Identity 'OU=Workstations,DC=corp,DC=local'.
2. Configure policy: Computer Configuration > Administrative Templates > System > LAPS. Set the backup directory, password age (30 days is common), length (at least 20) and complexity.
3. Grant read rights to the help desk group only: Set-LapsADReadPasswordPermission. Reading a password should be audited.
4. For Entra-joined devices, the same policy lives in Intune under Endpoint security > Account protection > Local admin password solution.

# Read a device's current LAPS password (requires read permission)
Get-LapsADPassword -Identity WS-FINANCE-04 -AsPlainText
# Force a rotation right now
Reset-LapsPassword

Tiered accounts: an admin credential never leaves its tier

The tiering model is a rule about where credentials are allowed to be typed. Tier 0 is identity: domain controllers, the PKI, Entra Connect, the backup server. Tier 1 is servers and applications. Tier 2 is workstations. An account from a higher tier never logs into a lower tier, so a compromised workstation can never hold a Tier 0 hash.

In practice that means each administrator has three accounts. A normal user account for email and browsing. A Tier 2 account for fixing workstations. A Tier 0 account used only from a dedicated admin workstation to manage domain controllers. Domain Admins should be nearly empty most of the time.

• Enforce it with Group Policy user rights on each tier: Deny log on locally, Deny log on through Remote Desktop Services, Deny log on as a batch job and Deny log on as a service for the higher tier groups, applied to lower tier OUs.
• Put every Tier 0 account in the Protected Users group. It disables NTLM, cached credentials and delegation for those accounts.
• Give Tier 0 admins a separate, hardened machine: a Privileged Access Workstation with no email client, no browser to the general internet, and its own firewall rules.
• Remove standing membership from Domain Admins. Use temporary group membership or Privileged Identity Management and add people for the change window only.

The supporting settings

A handful of Group Policy settings close the remaining gaps. None of them replace LAPS or tiering, but together they make the attacker's usual playbook noisy and slow.

1. Block inbound SMB and RDP between workstations with Windows Firewall. Workstations talk to servers, not to each other. This alone stops most worm-style spread.
2. Disable WDigest: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential = 0 so plaintext passwords are not cached.
3. Audit and alert on Event ID 4624 with logon type 3 from workstation to workstation, and on 4672 (special privileges assigned) for any Tier 0 account outside the admin workstations.

Frequently asked questions

Takeaway

Lateral movement needs a credential that works in more than one place. LAPS makes every local admin password unique, and tiering keeps domain admin hashes off workstations. Add workstation-to-workstation firewall rules and Protected Users, and the attacker who lands on a laptop stays on that laptop.