A municipal Windows estate has no LAPS-class local administrator password solution, so many workstations share the same local admin password. What risk should the tester highlight?
Select an answer to reveal the explanation.
Short Explanation
Picture one master key cut for every apartment in the building. Crack one lock and you walk the whole hallway. Unique per-host local admin passwords — LAPS-style — stop that lateral stroll.
Full Explanation
When many municipal workstations share one local administrator password, compromising a single host yields credentials that authenticate as local admin on peers. That reuse pattern enables wide lateral movement and host-level credential theft without first obtaining Domain Admin. For a city estate serving permitting, libraries, and public-safety offices, missing LAPS-class randomized local admin password management is therefore a high-impact Active Directory path finding: one foothold becomes many.
Cloud-join status does not erase the problem on domain-joined Windows fleets—the shared local secret still works host-to-host. Identical local admin passwords do not strengthen Kerberos or machine trust; they weaken isolation. Domain Admin coverage elsewhere is not a substitute for unique local admin secrets; assessors still need to show how lateral movement accelerates before or without domain dominance.
Exam caveat: LAPS (or equivalent) addresses local admin password uniqueness and rotation—do not confuse it with domain password policy for user accounts. CPTS reporting should distinguish host-lateral reuse from directory privilege escalation.
Operational check: sample local admin password hashes or LAPS/edge configuration across a representative civic workstation set, confirm uniqueness and rotation, and document remaining shared-password clusters in the AD attack-path section with remediation owners.