Which Microsoft tool can be used to mitigate the risk of an adversary reusing a stolen local administrator password hash?

Attack surface reduction rules in Microsoft Defender limit exposure to exploit vectors such as macros and obfuscated scripts, but do not address the reuse of stolen credential hashes for lateral movement.

LAPS (Local Administrator Password Solution) generates and rotates a unique password for the local administrator account on each Windows endpoint, storing it securely in Active Directory. Because every machine has a different local admin password, a stolen NTLM hash from one machine cannot be reused to authenticate to other machines on the network. This directly breaks the pass-the-hash lateral movement technique that attackers rely on.

ASLR (Address Space Layout Randomization) randomizes memory addresses to prevent reliable exploit code execution, which is a code execution mitigation unrelated to stolen password hash reuse.

Heap spray protection prevents attackers from placing shellcode in predictable heap memory locations; it is a memory exploit mitigation with no relevance to stolen credential reuse or lateral movement.