The Art of Killing Local Admin

Speakers

• Sandy Zeng
• Simon Skotheimsvik

About this session

Local administrator rights remain one of the most common ways attackers gain control of Windows devices. While many organizations want to remove local admin access, doing so without impacting productivity has always been a challenge. In this session, I'll share a practical methodology for eliminating local administrator rights in Microsoft Entra ID–joined environments using Microsoft Intune. We'll start with the foundations, including Entra ID security controls, settings in Windows Autopilot, and Microsoft LAPS, before building a privilege management strategy with Microsoft Endpoint Privilege Management (EPM). Now that EPM is available to more organizations through Microsoft 365 E5, IT teams finally have a license to kill local admin rights at scale. Through demonstrations, real-world lessons learned, and proven implementation approaches, you'll learn how to reduce attack surface, support end users, and successfully move toward a modern least-privilege model.