The Problem

The “need it now” scenarios happen more often than we’d like to admit:

• LAPS fails – Service disruptions, permission issues, password rotation problems, or the LAPS password simply won’t retrieve
• Domain connectivity breaks – Whether on-premises or cloud, when trust relationships fail or authentication services go down
• User accounts are locked – Profile corruption, account lockouts, or authentication loops that lock out everyone
• Urgent local troubleshooting – Immediate need for local admin access to diagnose hardware, driver, or system-level/security issues

When these happen, the device is online and Intune-managed, but you can’t get in. Even with physical access, you need working credentials.

The Solution: A Monitored Break-Glass Account

The solution consists of four key components:

1. Detection Script – Validates the emergency account exists, is enabled, and has proper permissions
2. Remediation Script – Creates or fixes the emergency account
3. Removal Script – Cleans up the account after the emergency
4. Defender Monitoring – Alerts when the break-glass account is created and used

Implementation

The solution consists of four PowerShell scripts that work together to provide complete lifecycle management:

1. Detection Script (Detect-EmergencyAdmin.ps1)

The detection script validates three critical conditions:

• Account exists
• Account is enabled
• Account is member of local Administrators group (verified by SID)

2. Remediation Script (Remediate-EmergencyAdmin.ps1)

The remediation script creates or repairs the emergency account:

• Creates the local user account if it doesn’t exist
• Sets AccountNeverExpires and PasswordNeverExpires flags
• Ensures the account is enabled
• Adds the account to the local Administrators group using SID-based membership
• Provides status output for Intune logs

3. Removal Scripts

After the emergency is resolved, cleanup is essential:

Detection Script for Removal (Detect-EmergencyAdmin-ForRemoval.ps1)

• Returns exit code 0 if account does NOT exist (desired state)
• Returns exit code 1 if account exists (needs removal)
• Reverse logic from creation detection

Remediation Script for Removal (Remove-EmergencyAdmin.ps1)

• Removes the break-glass account completely

Deployment in Intune

Creating the Remediation Package

1. Navigate to Devices > Scripts and remediations > Remediations
2. Click + Create script package
3. Configure the package:
   • Name: Emergency-Local-Admin-CREATE
   • Description: Creates emergency local administrator account for break-glass scenarios
   • Detection script: Upload Detect-EmergencyAdmin.ps1
   • Remediation script: Upload Remediate-EmergencyAdmin.ps1
   • Run this script using the logged-on credentials: No (must run as SYSTEM)
   • Enforce script signature check: No
   • Run script in 64-bit PowerShell: Yes

Best Practices for Deployment

Don’t run continuously! This solution should be deployed strategically and on demand. Keep the remediation scripts ready but unassigned. Deploy to affected devices/groups only during an incident.

Removal Deployment

Create a second remediation package for cleanup:

• Name: Emergency-Local-Admin-REMOVE
• Detection script: Upload Detect-EmergencyAdmin-ForRemoval.ps1
• Remediation script: Upload Remove-EmergencyAdmin.ps1
• Deploy after emergency is resolved

Monitoring with Defender for Endpoint

Creating the account is only half the solution – you need to know when it’s created and when someone uses it.

Custom Detection Rule – Account Creation

Create a custom detection rule in Microsoft Defender for Endpoint:

1. Navigate to Investigation & response > Advanced Hunting
2. Create a query to detect account creation:

DeviceEvents
| where ActionType == "UserAccountCreated" and AccountName =~ "Batman"

Custom Detection Rule – Account Usage

DeviceLogonEvents
| where ActionType == "LogonSuccess" and AccountName =~ "Batman"