Step reference

Local administrator

Create or update a managed / break-glass local admin account, with the password pulled from the vault at runtime and never stored in the template.

1 min readUpdated Jul 31, 2026

What it does

Creates or updates a local administrator account on the device: your managed "break-glass" account for support and recovery. The password is fetched from the vault at the moment the job runs, applied, and never logged or stored in the template. The account is guaranteed to exist before OOBE and before any user signs in.

Options

OptionWhat it controls
UsernameThe local admin account name. Defaults to LocalAdmin. Required.
PasswordThe vault secret holding the account password. Required.

Good to know

  • Idempotent. Running it again just re-applies the account and password, so it's safe to re-run.
  • If it can't create or update the account, the setup stops by default. A device with no known admin account is a device you can't support.

Check what OOBE configuration is doing before you add this step

Whether you need this step depends on how OOBE configuration is set up, because that step can create an admin account too.

  • OOBE configuration left at its default (the Skip the account screen fields blank) — it creates no account at all; the end user makes their own at first boot. Add this step for the management account you'll want at 2am.
  • OOBE configuration set to skip the account screen — the username and password you put there is a local admin account. Adding this step as well gives you two admin accounts on the device. That's only worth doing if you deliberately want the management account kept separate from the one the user signs in with.

Part of the step catalogue.