Step reference
Local administrator
Create or update a managed / break-glass local admin account, with the password pulled from the vault at runtime and never stored in the template.
What it does
Creates or updates a local administrator account on the device: your managed "break-glass" account for support and recovery. The password is fetched from the vault at the moment the job runs, applied, and never logged or stored in the template. The account is guaranteed to exist before OOBE and before any user signs in.
Options
| Option | What it controls |
|---|---|
| Username | The local admin account name. Defaults to LocalAdmin. Required. |
| Password | The vault secret holding the account password. Required. |
Good to know
- Idempotent. Running it again just re-applies the account and password, so it's safe to re-run.
- If it can't create or update the account, the setup stops by default. A device with no known admin account is a device you can't support.
Check what OOBE configuration is doing before you add this step
Whether you need this step depends on how OOBE configuration is set up, because that step can create an admin account too.
- OOBE configuration left at its default (the Skip the account screen fields blank) — it creates no account at all; the end user makes their own at first boot. Add this step for the management account you'll want at 2am.
- OOBE configuration set to skip the account screen — the username and password you put there is a local admin account. Adding this step as well gives you two admin accounts on the device. That's only worth doing if you deliberately want the management account kept separate from the one the user signs in with.
Part of the step catalogue.
Related
Install Windows 11
True bare-metal Windows 11 install with the right OEM driver pack injected automatically. Wipes the target disk; runs only on the USB entry point.
OOBE configuration
Auto-answer the out-of-box screens (region, keyboard, device name, EULA, optional Wi-Fi) and optionally skip the account screen so the device lands ready, with no duplicate admin.
Language & region
Set the display language, keyboard layout, regional format, home location and timezone for the installed Windows and every new user. Autopilot-compatible.