Local admin passwords

Security > Local admin passwords gives each machine's local administrator its own long random password and changes it on a schedule, like Microsoft LAPS, for Windows and Linux, with or without Active Directory. One stolen password then opens one machine, not the fleet, and it stops working at the next change. Admins only.

1. Go to Security > Local admin passwords and choose Edit policy (or Turn on) on the policy line under the status tiles.
2. Tick Change local admin passwords automatically.
3. Choose the groups of machines it covers.
4. Choose how often to change the passwords (days), the length (14 to 64, 20 by default), and how long after someone sees a password to change it again (24 hours by default; 0 never changes it after a view).

5. Optional: the account to manage.

   • Windows: the built-in Administrator by default, found by its well-known ID even if it was renamed. Enter another local account name to manage that one instead.
   • Linux: root by default. Enter another local account name to manage that one instead.
6. Click Save policy.

Within 5 minutes, every machine in the policy gets a new password. After that each one changes when it is due. A machine that is off changes when it reconnects.

1. Find the machine and click Show password.
2. Say why you need it, for example a ticket number. This goes in the audit log.
3. The password shows with a Copy button and clears from the screen after a minute.

The password changes again after the time set in the policy (24 hours by default), so a password someone has seen does not stay valid.

Click Change now on a machine, or Change all now for every machine in the policy.

• Gardience makes each password and keeps it in its own vault before sending it, so a lost answer from a machine can never leave it with a password nobody has.
• The password travels to the machine encrypted with that machine's own key. Salt's job history and logs never hold it. The machine sets it and answers with the account name only.
• If a machine does not answer, Gardience keeps the password it sent as Unconfirmed. Show password then shows each password the machine might have, and the next scheduled change sets a new one.
• The AI assistant, the MCP server, and API keys can never read these passwords.
• Every change (laps.rotated), view (laps.viewed, with the reason), and policy change (laps.policy) is in the audit log.

• A locked Linux account (no password sign-in, as root is on Ubuntu) is left locked. Setting a password would unlock it, so Gardience reports Locked, left alone instead.
• Domain controllers are skipped: they have no local accounts.
• An account that does not exist on a machine is reported; nothing is created.

• Secrets vault
• Disk encryption