Walk into most small offices and ask what the local administrator password is on the PCs. Somebody will know it. It was set years ago, it is the same on every machine, and it is probably written down near the server closet. That one password is the quiet reason a single infected laptop so often turns into an infected office.

Windows LAPS fixes this, and it is already inside Windows. Here is what it does, what you need, and how to turn it on whether your PCs live in Entra ID, Intune, or an on-prem domain.

What Windows LAPS Does

LAPS stands for Local Administrator Password Solution. It takes the local admin account on each Windows device, gives it a long random password that is different on every machine, and backs that password up to your directory: Microsoft Entra ID or Windows Server Active Directory. When the password reaches the age you set, Windows generates a new one and stores it again. Nobody has to remember anything, and nobody has to type the same password into forty machines.

It runs as a background task built into Windows that wakes up every hour to check its policy. It also protects the managed account from casual tampering, so a user with admin rights cannot simply change the password to something they like. And it can rotate the password automatically after someone signs in with it, which limits how long a password a technician just used stays valid.

Why One Shared Admin Password Is a Problem

Attackers love identical local admin passwords. Once they get onto one machine and pull that credential, every other PC with the same password opens up to them. Microsoft’s Intune documentation names the exact attacks LAPS is meant to stop: pass-the-hash and lateral traversal, where stolen local credentials get reused to hop from device to device. Ransomware crews depend on that hop. A unique password per machine turns one compromised laptop into one compromised laptop, which is a very different afternoon.

If you have ever cleaned up after an incident, you know how much that containment matters. Our walkthrough on what to do in the first hours of a ransomware attack covers the response side. LAPS is one of the cheapest ways to make that response smaller.

What You Need

A supported version of Windows. Windows LAPS is built into Windows 11 23H2 and later, and into older Windows 11 builds and Windows 10 that received the April 11, 2023 update or later. Windows Server 2019 and newer support it too. Microsoft notes that Windows 10 only keeps LAPS on devices that still receive updates, such as through Extended Security Updates, so new deployments should target Windows 11.

The right license. This is the part people overpay for in their heads. Microsoft states that LAPS is available to all customers with Microsoft Entra ID Free or higher. Intune, Conditional Access, custom roles, and administrative units carry their own licensing, but the LAPS feature itself does not need a premium tier.

A decision about where passwords live. If your PCs are Microsoft Entra joined or hybrid joined, back them up to Entra ID. If they are joined to an on-prem domain and you manage them with Group Policy, Active Directory is the usual home. Each device backs up to one directory.

Nothing to download. The old standalone Microsoft LAPS MSI is deprecated. Windows 11 23H2 and later block it from installing, and Microsoft is not making code changes to it. Everything below uses the version already inside Windows.

Setup With Entra ID and Intune

For most small businesses running Microsoft 365, this is the path. There are two halves: switch LAPS on for the tenant, then push a policy to the devices.

Turn it on in Entra. Sign in to the Microsoft Entra admin center as at least a Cloud Device Administrator. Go to Entra ID, then Devices, then Overview, then Device settings. Set Enable Local Administrator Password Solution to Yes and save. Until this switch is on, devices have nowhere to send their passwords.

Create the Intune policy. In the Intune admin center, go to Endpoint security, then Account protection, and create a policy for Windows using the Local admin password solution profile. Set the backup directory to Microsoft Entra ID, pick a password age, and choose a complexity and length you are happy with. Assign it to a device group, starting with a few test machines.

Mind the account name. LAPS manages one local admin account per device. If you leave Administrator Account Name blank, the policy targets the built-in administrator account. If you type a name and that account does not exist on the device, Intune notes that no account gets managed at all, so check the spelling against a real machine. On Windows 11 24H2 and later, the automatic account management settings can create and manage the account for you.

One more thing Intune documents clearly: LAPS settings delivered through Intune take precedence over Group Policy and the legacy LAPS tool. If you are moving a device from GPO to Intune, the Intune settings win.

Setup With On-Prem Active Directory

If your PCs are domain joined and managed with Group Policy, the setup happens in three steps. First, extend the schema. This is a one-time operation for the whole forest, run from a Windows Server 2019 or later domain controller or any server with the LAPS PowerShell module:

Update-LapsADSchema -Verbose

Second, give computers permission to write their own password to their computer object. Point this at the OU that holds your workstations:

Set-LapsADComputerSelfPermission -Identity "OU=Workstations,DC=contoso,DC=com"

Third, configure the policy. In Group Policy Management Editor, go to Computer Configuration, Policies, Administrative Templates, System, LAPS. Set the password backup directory to Active Directory and set the password age and complexity. Microsoft supports encrypting the stored password in Active Directory and limiting who can decrypt it, which is worth turning on so a broad read permission does not expose every admin password in the domain.

Getting a Password When You Need One

In Entra, browse to Entra ID, then Devices, then Overview, then Local administrator password recovery to see LAPS-enabled devices and recover a password. Who can read it matters. By default, Cloud Device Administrators and Intune Service Administrators can read the actual password. Helpdesk Administrators, Security Administrators, and Security Readers can see the metadata but not the password itself.

From PowerShell, the Entra version uses Microsoft Graph and needs the DeviceLocalCredential.Read.All permission to return the clear-text password:

Connect-MgGraph -Scopes "Device.Read.All","DeviceLocalCredential.Read.All"
Get-LapsAADPassword -DeviceIds "PC-FRONTDESK" -IncludePasswords -AsPlainText

For domain-joined machines, the Active Directory version is a single line:

Get-LapsADPassword -Identity "PC-FRONTDESK" -AsPlainText

Every recovery in Entra is audited. Under Entra ID, Devices, Overview, Audit logs, filter for Recover device local administrator password and you can see who pulled which password and when.

Forcing a Rotation

After a technician uses the password, or after anything that smells like a compromise, rotate it instead of waiting for the schedule. LAPS can do this on its own: configure the post-authentication action and Windows resets the password after the account is used, with a grace period so the person signed in can finish their work.

To do it by hand on the device itself, these two cmdlets cover it. The first rotates the password now. The second makes Windows process its LAPS policy immediately instead of waiting for the next hourly cycle:

Reset-LapsPassword
Invoke-LapsPolicyProcessing

In Active Directory you can also expire the password from the server side with Set-LapsADPasswordExpirationTime, and the device rotates it on its next policy run. Intune can rotate the password on demand from the admin center as well.

Moving Off Legacy LAPS

If you still run the old MSI-based LAPS, you are not stuck. Microsoft supports running Windows LAPS and legacy LAPS side by side, with one rule: the two policies must target different local accounts. The long-term plan is to migrate fully, and Microsoft publishes a migration guide covering both an immediate switch and a gradual one. Since newer Windows 11 releases refuse to install the old MSI anyway, every new PC you deploy is already pushing you toward Windows LAPS.

Pair LAPS with the identity side of the house. Unique local passwords stop lateral movement on the device. Conditional Access stops a stolen cloud password from being enough on its own. You want both.

References

Want LAPS rolled out across your PCs without breaking anyone’s day? Contact Rain City Techworks.