Local administrator

What it does

Creates or updates a local administrator account on the device — your managed "break-glass" account for support and recovery. The password is fetched from the vault at the moment the job runs, applied, and never logged or stored in the template. The account is guaranteed to exist before OOBE and before any user signs in.

Options

Option	What it controls
Username	The local admin account name. Defaults to LocalAdmin. Required.
Password	The vault secret holding the account password. Required.

Good to know

• Pair it with OOBE configuration on non-Autopilot builds: OOBE handles the end-user account, this step provides the management account underneath.
• Idempotent — running it again just re-applies the account and password, so it's safe to re-run.
• If it can't create or update the account, the setup stops by default — a device with no known admin account is a device you can't support.

Part of the step catalogue.