Locked Out of Client PC: Emergency Local Admin via RMM

LIMEHAWK - Managed IT

Home>Incident Reports>Locked Out of Client PC: Emergency Local Admin via RMM

Endpoints

Security incident

Monday, 7:43 AM. Call from a client we'd been managing for three years — 85-person accounting firm. Their internal IT director had resigned Friday afternoon. Somewhere between cleaning out his desk and walking out the door, he'd changed the domain admin password on both DCs. Then, because he was the one who knew how, he also changed the DSRM recovery password on both. Nobody else had working admin credentials. Payroll was due Wednesday.

This is the textbook malicious insider scenario. Domain admin account locked. Can't log into the DCs. Can't reset passwords through AD because we can't authenticate to AD. But our RMM agent was installed on every workstation and every server — including the DCs — and it was still checking in, still running as SYSTEM.

Assessment

- domain admin: password changed by the departing employee, locked out
- DSRM password: also changed — can't boot DC into recovery mode
- built-in Administrator: disabled on workstations per the client's security policy
- LAPS: enabled, passwords stored in AD — which we cannot currently read
- RMM agent: installed on all 92 endpoints, running as SYSTEM

Here's the thing about RMM agents: SYSTEM is more privileged than any domain admin on the local machine. The departing IT director could change every password in Active Directory — what he couldn't do is reach into our RMM tenant and disable the agent. It was still checking in, still running, still had full local system privileges on 92 machines. We had a path.

Why we couldn't just reset the domain admin

The standard recovery path for a compromised domain admin is DSRM: boot the DC into Directory Services Restore Mode and reset the admin account from there. That was closed:

- DSRM password: already changed by the same departing employee
- offline password reset: possible, but requires booting from external media and working on the NTDS and SAM hives — risky on a production DC, time-consuming, and we had 85 people who needed to work in the morning
- DC RMM agent: installed, but useless for this — you can't reset a domain admin account via SYSTEM on a DC, that's an AD operation
- business impact: 85 people couldn't do anything, payroll deadline in 48 hours

We'd deal with DC recovery separately. The immediate need was local admin on the workstations so people could get logged in and working with their cached domain credentials while we untangled AD in the background.

Resolution

Pushed a script to all 92 endpoints via RMM, simultaneously. SYSTEM privileges let us create a new local admin account on every machine, bypassing the compromised domain entirely. Each machine got a unique, cryptographically random password stored back into an encrypted custom field on the endpoint in RMM.

Technical details

- RNGCryptoServiceProvider — cryptographically secure randomness, not the pseudo-random System.Random
- 24-character password with 70 possible characters — 70^24 combinations, brute force is not a concern
- idempotent design — if the account exists, reset its password; if not, create it. Safe to rerun as many times as you want.
- JSON output to stdout — structured, so RMM parses it into the encrypted custom field on that endpoint. No plaintext passwords in log files.

Every machine gets a different password. If one endpoint is compromised, the attacker has that machine's local admin, not the keys to the other 91. Same principle behind Microsoft LAPS, just implemented via RMM instead of AD — which matters here, because AD is exactly what we can't trust right now.

Outcome

Within 3 minutes of the call, all 92 machines had working local admin accounts. Staff logged in with cached domain credentials, and we had a way to elevate locally for any follow-up work. Business never stopped.

DC recovery took the rest of the day — about 6 hours, done via offline NTDS extraction on a copy of the database, resetting the KRBTGT and admin credentials, then bringing the DCs back online. Payroll ran on time Wednesday.

- local admin restored: 3 minutes across all 92 endpoints
- domain recovered: 6 hours (full AD access restored)
- business impact: zero downtime, payroll on schedule

Key takeaways

Takeaway

RMM running as SYSTEM is break-glass access for when the domain itself is compromised — it's the one thing an insider can't easily reach if they're not in your RMM tenant.

Takeaway

we now deploy this script as part of every client onboarding, so a break-glass local admin exists on every endpoint from day one.

Takeaway

unique passwords per machine stop lateral movement cold — one compromise is one machine, not the whole fleet.

Takeaway

insider threats can't disable what they don't control; keep your management plane outside the client's identity provider.

Need help with something like this? Contact us

• Getting Verification Codes You Didn't Request? How to Tell Spam From Account Compromise (Security)

• Finding Your BitLocker Recovery Key After a Windows Update Breaks Boot (Security)

• BEC Wire Fraud at a Title Company: How We Stopped a High-Six-Figure Loss (Security)