The Silent Risk of SID-500: Why LAPS Alone Is Not Enough

The built-in local Administrator account (SID ending in -500) is a well-known target for attackers. Even in environments where Microsoft LAPS is deployed, this account can still be manually enabled, abused temporarily, and then disabled again — often without immediate visibility.

This PowerShell solution adds an extra defensive layer by continuously monitoring and disabling the SID-500 account if it becomes active.

📌 Key Points

• Continuously monitors the built-in Administrator account (SID-500)
• Automatically disables the account if it becomes active
• Runs silently in the background as SYSTEM
• Complements Microsoft LAPS — does not replace it

⭐ What This Script Does

1️⃣ Creates a Persistent Monitor Script

• Writes DisableSID500Monitor.ps1 to C:\ProgramData
• Checks the SID-500 account state on every execution

2️⃣ Creates a Scheduled Task

• Task name: DisableSID500Monitor
• Execution interval: Every 30 minutes
• Duration: 10 years
• Execution mode: Hidden / non-interactive

3️⃣ Runs as SYSTEM (Highest Privileges)

• Cannot be blocked by standard users
• Runs even when no user is logged in
• Reliable for shared or locked-down devices

⭐ How the Monitoring Logic Works

• Identifies the built-in Administrator by SID ending in -500
• Checks whether the account is enabled
• If already disabled → no action
• If enabled → immediate remediation

⭐ Why This Matters — Even with LAPS Enabled

Microsoft LAPS only manages the password, not the account state.

Remaining risks:

• An admin (or attacker with admin rights) can enable SID-500
• Use it briefly for persistence or lateral movement
• Disable it again to avoid detection
• Password rotation still occurs — but the damage is already done

This script:

• ⭐ Detects activation
• ⭐ Reacts automatically
• ⭐ Reduces the attack window to minutes

PowerShell Script

# ===========================================
# DisableSID500Monitor - Main Script
# Creates:
#   - C:\ProgramData\DisableSID500Monitor.ps1
#   - Scheduled task "DisableSID500Monitor"
# ===========================================

$taskName = "DisableSID500Monitor"
$scriptPath = "C:\ProgramData\DisableSID500Monitor.ps1"

# If the task already exists – remove and recreate it
if (Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue) {
    Unregister-ScheduledTask -TaskName $taskName -Confirm:$false
}

# =============================
# The actual monitor script
# =============================
$monitorScript = @'
# SID500 monitor script

# Retrieve the built‑in Administrator account (SID 500)
$admin = Get-LocalUser | Where-Object { $_.SID -like "*-500" }

if ($admin -eq $null) {
    Write-Output "Could not locate the SID500 account."
    exit
}

if ($admin.Enabled -eq $true) {
    Write-Output "SID500 account is ACTIVE — attempting to disable..."

    try {
        Disable-LocalUser -Name $admin.Name -ErrorAction Stop
        Write-Output "SID500 disabled successfully via Disable-LocalUser."
    }
    catch {
        # Fallback method: NET USER (works on all Windows versions)
        & "$env:SystemRoot\System32\net.exe" user $($admin.Name) /active:no
        Write-Output "SID500 disabled via NET USER fallback."
    }
}
else {
    Write-Output "SID500 is already disabled."
}
'@

# Save the monitor script to disk
$monitorScript | Set-Content -Path $scriptPath -Encoding UTF8 -Force

# ===============================
# Create the scheduled task
# ===============================

# Runs powershell.exe silently and executes the monitor script
$action = New-ScheduledTaskAction `
    -Execute "powershell.exe" `
    -Argument "-NoLogo -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File `"$scriptPath`""

# Trigger: Run once now + repeat every 30 minutes for 10 years (3650 days)
$trigger = New-ScheduledTaskTrigger `
    -Once -At (Get-Date) `
    -RepetitionInterval (New-TimeSpan -Minutes 30) `
    -RepetitionDuration (New-TimeSpan -Days 3650)

# Run as SYSTEM
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -RunLevel Highest

# Register the task
Register-ScheduledTask `
    -Action $action `
    -Trigger $trigger `
    -Principal $principal `
    -TaskName $taskName `
    -Description "Monitors and disables the SID500 built‑in administrator account if enabled."

Write-Host "Scheduled task '$taskName' has been created."
Write-Host "Monitor script saved at: $scriptPath"