Windows local admin account: Rotate password

[noahtalerman]

Goal

User story
As an IT admin that used a local admin account for troubleshooting,
I want Fleet to rotate the account's password
so that I can be confident admin credentials aren't leaked.

Changes

Product

• Changes: Based on existing rotate password for macOS hosts, extend support to Windows local admin accounts.
• UI changes: Extend existing UI for macOS to Windows:
  • Host details > Actions > Show managed account
• CLI (fleetctl) usage changes: No changes
• YAML changes: No changes
• REST API changes: [API] Update description for managed account password retrieval #48804
• Fleet's agent (fleetd) changes: No changes
• Fleet server configuration changes: No changes
• Exposed, public API endpoint changes: No changes
• fleetdm.com changes: No changes
• GitOps mode UI changes: No changes Same as existing behavior for macOS
• GitOps generation changes: No changes
• Activity changes: Extend type Triggered managed local account password rotation to include Windows activity
• Permissions changes: No changes
• Changes to paid features or tiers: No changes Same as existing for macOS—Premium
• My device and fleetdm.com/better changes: No changes
• Usage statistics: No changes
• Other reference documentation changes: No changes
• First draft of test plan added
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• Contributor API changes: No changes
• Feature guide changes: Update https://fleetdm.com/guides/secure-local-admin-passwords to include Fleet's built-in Windows password rotation via Host details > Actions > Show managed account.
• Database schema migrations: No changes
• Load testing: Not required — extending existing macOS password rotation to Windows, no new high-volume path.
• Pre-QA load test: Not required — no change to Fleet's load profile.
• Load testing/osquery-perf improvements: Not required — no osquery-perf or load test environment changes needed.
• This is a premium only feature: Yes

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

Risk assessment

• Requires testing in a hosted environment: No
• Requires load testing: No
• Risk level: Medium
• Risk description: Medium risk — security-critical feature (admin password management) on a new platform. Windows password rotation mechanics differ from macOS; bugs could lock out admins or leave passwords unrotated.

Test plan

Make sure to go through the list and consider all events that might be related to this story, so we catch edge cases earlier.

Core flow

• Verify Host details > Actions > Show managed account option:
  • shows when managed account is created for Windows
  • does not show if managed account is not created for Windows
• Verify same functionality as macOS rotate password in UI and API for Windows
• Verify activity shows as expected for type Triggered managed local account password rotation on Windows and macOS platforms
• Trigger password rotation and verify the new password is displayed when selecting Show managed account
• Verify the rotated password works by logging into the Windows host with the new credentials
• Verify existing macOS password rotation is unaffected

UI

• Verify that all UI changes specified in the Figma wireframes are correctly implemented
• Verify expected UI states (loading, empty, error states if applicable)

API

• Test all API endpoints added or modified in the API changes section of this issue

Permissions

• Verify role restrictions are applied correctly for global roles
• Verify role restrictions are applied correctly for fleet-level roles
• Verify non-premium instances do not have access to Windows password rotation

Edge cases

• Verify rotation behavior when the host is offline, MDM-unenrolled, or running unsupported fleetd
• Verify the escrowed password matches the host's actual password after concurrent or repeated rotations
• Verify error handling when the local admin account is renamed, deleted, disabled, or changed on the host
• Verify the password is never exposed in activities, audit logs, or API responses to unauthorized roles

Supplemental testing

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan (include any special setup, test data, or configuration used during development/testing if applicable).
2. QA: Added comment to user story confirming successful completion of test plan.