Get local admin on one box. Reuse the creds. Move sideways. Repeat.

That era is quietly ending.

Not because attackers suddenly got worse — but because Microsoft hardened Windows in ways many people never noticed, one registry key at a time.

This article breaks down:

  • what LocalAccountTokenFilterPolicy actually does
  • why even RID 500 (the built-in Administrator) is no longer special
  • how this impacts lateral movement in real environments
  • and what professional red teamers adjust instead of complaining

The Old World: Local Admin = Lateral Movement

Historically, if you had:

  • a local admin password
  • or NTLM hash
  • or credential material for a local account

You could:

  • authenticate remotely (SMB, WMI, WinRM, etc.)
  • get full admin access
  • pivot laterally with minimal friction

This worked even if:

  • the account was local
  • the account wasn't domain-joined
  • the admin was "just local"

Especially powerful was RID 500 — the default built-in Administrator.

Enter Token Filtering (The Thing That Changed Everything)

Microsoft introduced User Account Control (UAC) not just for desktops — but for remote access too.

The result is remote token filtering.

When a local account authenticates remotely:

  • Windows strips admin privileges
  • issues a filtered token
  • blocks high-risk operations

This behavior is controlled by a single registry value:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
LocalAccountTokenFilterPolicy

What LocalAccountTokenFilterPolicy Actually Does

Let's be precise.

Default behavior (value = 0 or missing)

  • Local accounts authenticating remotely receive: - filtered (non-admin) tokens
  • Even if the account: - is in the local Administrators group - has full rights locally

This applies to:

  • SMB
  • WMI
  • WinRM
  • remote service control
  • scheduled tasks
  • registry access

In short: Remote ≠ Local privileges

Legacy behavior (value = 1)

When explicitly set to 1:

  • local admin accounts receive full admin tokens remotely
  • classic lateral movement returns

Microsoft strongly discourages this configuration now.

"But What About RID 500?"

This is where many people are surprised.

Historically:

  • RID 500 (built-in Administrator) bypassed many UAC restrictions
  • It was treated as "special"

That is no longer reliably true.

Modern Windows versions:

  • apply remote token filtering even to RID 500
  • treat it like any other local admin when authenticating remotely
  • unless explicitly overridden

This quietly killed a massive amount of legacy attack paths.

Why This Breaks So Many Old Playbooks

If you've ever thought:

"I have local admin, why can't I do X remotely?"

This is why.

Common failures:

  • PsExec returns access denied
  • sc.exe can't create services
  • registry access blocked
  • scheduled task creation fails
  • WMI execution doesn't elevate

Not a patch issue. Not an exploit failure. Token filtering.

Why Microsoft Did This (And Why It Makes Sense)

From Microsoft's perspective:

  • local admin reuse was a massive lateral movement risk
  • especially in flat network
  • especially with password reuse

Token filtering:

  • preserves local admin power
  • limits remote abuse
  • forces attackers to escalate properly

It doesn't break normal usage. It breaks lazy lateral movement.

What This Means for Red Teamers (Reality Check)

Professional red teamers adapted years ago.

Instead of relying on local account reuse, they focus on:

  • domain identities
  • delegated rights
  • service accounts
  • scheduled tasks created locally
  • credential material usable locally first
  • coercing SYSTEM locally, then pivoting

Local admin is now a stepping stone, not a pivot point.

Common Bypass Myths (And Why They Fail)

❌ "Just use RID 500" → filtered remotely

❌ "Disable UAC" → not always possible, often monitored

❌ "Use different tools" → tools don't change token semantics

This is an OS behavior, not a tooling problem.

Defender Takeaway (This Matters)

If you're defending Windows environments:

  • leaving LocalAccountTokenFilterPolicy at default is good
  • enabling it (=1) re-opens lateral movement
  • RID 500 is no longer a safety net

This single setting has:

  • reduced credential replay attacks
  • forced attackers into noisier paths
  • raised the bar for internal movement

The Bigger Lesson Most People Miss

This isn't about one registry key.

It's about a shift in philosophy:

Microsoft is killing "easy lateral movement," not hacking.

Attackers didn't disappear. They were forced to be better.

And defenders who understand why this works are far ahead of those who just memorize settings.

Final Thought

If your attack chain still assumes:

  • local admin = lateral movement

You're living in the past.

Modern Windows environments require:

  • deeper identity abuse
  • smarter escalation paths
  • better understanding of tokens and privileges

The sooner you internalize that, the more effective you become.

None