A local admin is a user or service account on a single device that has elevated control over that machine. It can install software, change system settings, manage other users, and often disable security tools. Unlike a domain or cloud administrator, its power is usually limited to one endpoint, but that still makes it a high-value privilege level.
In cyber security, local admin matters because compromise of one account can turn a simple endpoint foothold into full device control. Attackers who obtain local admin rights may add persistence, tamper with defenses, or launch malware with higher permissions. Defenders reduce this risk by removing standing local admin rights, using endpoint privilege management for just-in-time elevation, and monitoring for unauthorized privilege changes.