Windows Local Administrator Password Solution (LAPS) for Microsoft Entra ID

Platforms

Windows

Products

IntuneEntra IDWindows LAPS

Result

A unique, rotating local admin password per device, backed up to Entra ID and readable by authorized admins

Overview

Protect the local Administrator account on every Entra joined PC: turn on Windows LAPS in Microsoft Entra ID, set the password rules in an Intune Account protection policy, and read or rotate passwords from the admin centers.

Every Windows machine has a built-in local Administrator account that has full permissions on the device and can’t be deleted, so it's important to protect this account from Pass-the-Hash (PtH) and lateral-movement attacks. In April 2023 Microsoft released a public preview of the new Windows Local Administrator Password Solution (LAPS) with support for Microsoft Entra ID (formerly Azure AD). Windows LAPS is a new product and the successor of the Legacy Microsoft LAPS solution, which managed local account passwords (stored in on-premises AD) for traditional domain-joined Windows computers.

Windows LAPS is now built into Windows 10, Windows 11 and Windows Server 2019 and later, with no client to install (no MSI package needed). It only requires the security update from April 11, 2023 or later. When LAPS is enabled and configured, it supports password encryption, password complexity, password history and rotation. It automatically manages and backs up the password of a local Administrator account on Windows devices joined to a traditional on-premises AD domain, as well as on Microsoft Entra joined and Microsoft Entra hybrid joined devices (joined to both Microsoft Entra ID and an on-premises AD domain).

For hybrid devices, an administrator can choose where to back up the passwords with the Backup Directory setting:

• Back up the passwords to Microsoft Entra ID only
• Back up the passwords to Active Directory only

Note: Windows devices that are joined only to Microsoft Entra ID can back up passwords only to Microsoft Entra ID.

This Windows LAPS release has more features, such as Role-Based Access Control (RBAC) for passwords stored in Microsoft Entra ID. On Windows Server domain controllers, LAPS can also manage and back up the Directory Services Restore Mode (DSRM) account password, which is used in an emergency to repair the AD database or restore it (or individual objects) from backup.

In this post I focus on Windows LAPS configuration for Windows 10/11 Microsoft Entra joined devices enrolled in and managed by Microsoft Intune.

Prerequisites

Before you start, check that you have the following.

Configuration

With the prerequisites in place, enable LAPS in Entra ID first, then create the Intune policy.

Step	Console	What you set
3.1	Entra	Enable Microsoft Entra LAPS for the tenant
3.2	Intune	Account protection policy for Windows LAPS
3.3	Intune	Settings catalog profile that enables the built-in Administrator (optional)

Enable LAPS in Microsoft Entra ID

Microsoft Entra admin center

Sign in to the Microsoft Entra admin center (entra.microsoft.com) and go to Entra ID > Devices > Overview > Device settings:

• Enable Microsoft Entra ID Local Administrator Password Solution (LAPS): Yes

Account Protection policy in Intune

Intune admin center

Open the Microsoft Intune admin center (intune.microsoft.com), go to Endpoint security > Account protection and click + Create Policy:

• Platform: Windows (shown as Windows 10 and later in my screenshot)
• Profile: Local admin password solution (Windows LAPS)

Example Account Protection policy settings:

• Backup Directory: Backup the password to Microsoft Entra ID only
• Password Age Days: 30 days
• Administrator Account Name: Not configured (the built-in Administrator account is used)
• Password Complexity: Large letters + small letters + numbers + special characters
• Password Length: 16 characters
• Post Authentication Actions: Reset the password and logoff the managed account: upon expiry of the grace period…
• Post Authentication Reset Delay: 8 hours

Optional: Enable the built-in local Administrator account

Intune admin center

If you don't use a custom local admin account for Windows LAPS (Administrator Account Name: Not configured), you need to enable the built-in Administrator account.

Use a Settings Catalog profile to enable the account:

• Accounts Enable Administrator Account Status: Enable

Note: If the Administrator account was disabled and its current password does not meet the password requirements, you cannot re-enable it.

Admin and user experience

In the Microsoft Entra admin center (entra.microsoft.com), Microsoft Entra ID > Devices > Local administrator password recovery (Preview) lists all devices with Windows LAPS enabled:

An administrator can pick a device and reveal the password of its LAPS-managed account by clicking Show local administrator password:

Signing in as the local Administrator on Win11client01:

In Event Viewer on the Windows 11 client, you can see the following events under Applications and Services Logs > Microsoft > Windows > LAPS:

• Event ID 10010: LAPS is configured to backup passwords to Microsoft Entra ID
• Event ID 10022: The current LAPS policy is configured as follows…
• Event ID 10041: LAPS detected successful authentication for the current managed account…

Note: The Windows LAPS policy rotates the account password automatically after it has been used (Post Authentication Actions: Reset), which is why Event ID 10041 is logged.

Besides the scheduled rotation, you can use a device action in the Microsoft Intune admin center to manually rotate the local admin password:

The admin account password can also be retrieved in the Intune admin center, on the device page under Local admin password: