Admin password rotation changes the password of a local administrator account on a fixed schedule and keeps each new password stored securely. Use it so a single admin password cannot be reused across devices or for months on end.

Feature/Functionality

Overview

The control is available on macOS and Windows:

Check two things before you set it up:

• macOS needs a second admin with a SecureToken. On a Mac, only an admin that holds a SecureToken can change the password of another account. That admin's password must also be stored in Factorial IT. The account created through Admin management gets its SecureToken the first time someone logs in with it. The SecureToken rules article covers this in detail.
• The generated password must pass your password policy. Compare the Password requirements you choose with your password policy. If the new password breaks the policy, the device rejects it.

How to use

1. Go to MDM > Controls > Add new control and choose Admin password rotation.
2. In Rotate passwords for all accounts matching, type the username of the local administrator account you want to rotate, for example admin-it. Upper and lower case are treated the same.
3. Pick how often the password changes: Every month, Every 2 months, Every 3 months or Every 6 months.
4. Pick the Password requirements, which set how strong each new password is:

5. Choose the targeting: all devices, specific device groups, or a custom target.

How rotation works

Factorial IT changes the password of each local administrator account on the device whose username matches the control. Standard accounts and non-local accounts are left alone.

• First rotation. The interval starts from the date the account was created or the date its password last changed. Once that interval is over, Factorial IT creates a new password, sets it on the device and keeps an encrypted copy in the Factorial IT console.
• Accounts that Factorial IT did not create. If the account was already on the device, Factorial IT has no record of its password. It sets a new one at the next sync and then follows the normal schedule. The old password is replaced.
• More than one control on the same device. If several rotation controls target one device, the device gets the shortest interval and the strongest password requirements among them.

To see the current password, open the device, go to the Users tab and click Actions > Display password on the account card.

Compliance statuses

Each device gets one result for the Admin Password Rotation compliance rule:

Edit or turn off the control

Open the control from MDM > Controls to change it or turn it off. Turning it off stops future rotations. The password currently on the device stays as it is.

Troubleshooting and FAQ

Troubleshooting

• The device shows "Compliant, no account to rotate". No local admin on the device matches the username. Check the spelling in the control, or create the account with Admin management.
• A Mac shows "Error, no SecureToken admin". No other admin on that Mac has both a SecureToken and a password stored in Factorial IT. Make sure the managed admin account exists and has been logged into at least once.
• The device shows "Error, account not created by Factorial IT". The account existed before the control. Factorial IT replaces its password at the next sync, after which the status updates.
• The status stays on "Pending". The new password has been sent but the device has not applied it. Check that the device is online and syncing.
• The device keeps rejecting the new password. The password requirements in the control probably conflict with your password policy. Align the two.

FAQ

1. Where do I find the current admin password?
   Open the device, go to the Users tab and click Actions > Display password on the account card.
    
2. Are standard user accounts rotated?
   No. Only local administrator accounts whose username matches the control are rotated.
    
3. What happens to an admin account that was already on the device?
   Its password is overwritten at the next sync. From then on it follows the rotation schedule.
    
4. If I turn the control off, does the password change back?
   No. Rotation stops and the last password stays on the device.
    
5. What if two controls target the same device?
   The device uses the shortest interval and the strongest password requirements from those controls.