Medical Device Maker — 2026-May-26

Audit and remediate local administrator access across a Windows endpoint fleet, delivering an audit-defensible attestation package and a repeatable control to prevent privilege drift.

• Audited local Administrators group membership, the built-in local admin account, and directory-level device-admin roles on every in-scope device
• Built a repeatable PowerShell detection and remediation workflow producing standardized per-device evidence, consolidated into a single attestation report
• Scoped Windows LAPS to replace shared local-admin passwords with per-device rotating credentials
• Recommended converting the one-time audit into a continuous, quarterly-attested control to stop configuration drift