Windows LAPS¶
Every Windows device has a local administrator account. If it has the same password everywhere, one stolen password unlocks every device. Windows LAPS (Local Administrator Password Solution) gives each device a unique, random password, rotates it on a schedule, and stores it in Microsoft Entra ID (or Active Directory) for authorized admins.
Windows LAPS is built into Windows. It replaces the old LAPS MSI ("legacy LAPS"), and Intune's policy takes precedence over other LAPS configuration on the device.
Prerequisites¶
- Windows 11 22H2 or later, or Windows 10 22H2, with the April 2023 updates or later.
- Turn on LAPS in Entra ID: Entra ID > Devices > Device settings > Enable Microsoft Entra Local Administrator Password Solution (LAPS) = Yes. Without this, devices can't back up passwords to Entra ID.
- Devices back up to either Entra ID or Active Directory, never both. Entra joined devices must use Entra ID.
Create the policy¶
Go to Endpoint security > Account protection > Create policy > Windows > Local admin password solution (Windows LAPS).
| Setting | Recommendation |
|---|---|
| Backup directory | Microsoft Entra ID |
| Password age (days) | 30 is a common choice. Entra ID backup allows 7 to 365. |
| Administrator account name | Leave empty to manage the built-in Administrator, or name a custom account |
| Password complexity | Large letters, small letters, numbers and special characters; or a passphrase option for passwords people can read out over the phone |
| Password length | 14 or more (passphrases are measured in words instead) |
| Post-authentication actions | Reset the password and sign out the managed account (the default). Once someone uses the password, it's rotated. |
| Post-authentication reset delay | A few hours, so the support session can finish |
Automatic account management (Windows 11 24H2 and later)¶
LAPS can now create and manage the account itself:
| Setting | Use |
|---|---|
| Automatic account management enabled | Turn on to let LAPS manage the account lifecycle |
| Target | The built-in Administrator, or a new custom managed account |
| Name or prefix | A name for the account, optionally randomized so attackers can't guess it |
| Enable account | Whether the managed account is enabled |
This also strengthens LAPS tamper protection on the account.
Who can see passwords¶
Two different permission systems are involved:
| Task | Permission needed | Built-in roles that have it |
|---|---|---|
| Create and edit LAPS policy | Intune Security baselines permissions | Endpoint Security Manager |
| View the password | Entra ID: microsoft.directory/deviceLocalCredentials/password/read |
Cloud Device Administrator, Intune Administrator |
| View metadata only (account, last and next rotation) | Entra ID: microsoft.directory/deviceLocalCredentials/standard/read |
Also Helpdesk Administrator, Security Administrator, Security Reader |
| Rotate the password from Intune | Intune: Managed devices Read, Organization Read, Remote tasks Rotate Local Admin Password | None. No built-in Intune role includes it. Create a custom role. |
For service desk staff, create a custom Entra role with the password read permission (optionally scoped to an administrative unit) and a custom Intune role with the rotate permission. Protect password retrieval with a Conditional Access policy that requires phishing-resistant MFA for those roles.
Retrieve and rotate¶
- View: Devices > All devices > select the device > Local admin password > Show. Each view writes an audit event in Entra ID.
- Rotate now: device menu (...) > Rotate local admin password. The next scheduled rotation resets from that point.
- List all LAPS devices: Entra admin center > Entra ID > Devices > Local administrator password recovery.
Sign in on the device with the local account name prefixed by .\, for example .\Administrator.
Deleting the Entra device deletes the password
When a device is deleted from Entra ID, its stored LAPS password is gone, and there's no way to recover it from Entra ID. If you might need local access to a device you're retiring, get the password first.
Troubleshooting¶
LAPS logs to Applications and Services Logs > Microsoft > Windows > LAPS > Operational.
| Event | Meaning |
|---|---|
| 10028 | LAPS couldn't update Entra ID with the new password. Check that LAPS is enabled in Entra ID, the device isn't disabled or deleted, and dsregcmd /status is healthy. |
| 10027 | The LAPS password doesn't meet the device's local password policy. Look for a conflicting password policy from Intune or GPO. |
To force a rotation and backup on the device for testing, run Invoke-LapsPolicyProcessing then Reset-LapsPassword in an elevated PowerShell session.