Windows LAPS for IT Teams: Setup, Password Retrieval and the 24H2 Features

Updated: November 2026. Supported versions, policy defaults, roles, event IDs and portal paths checked against Microsoft Learn on 11 November 2026.

One local admin password shared by every PC works like a skeleton key: steal it once and it opens the whole fleet. Microsoft's fix is built into Windows, but where you back it up and who can read it decide whether it holds. This guide covers Windows LAPS as of November 2026: setup in Intune and Group Policy, recommended settings, password access and what Windows 11 24H2 added.

TL;DR

• What it is. Built into Windows, it rotates one local admin password per device and backs it up to Entra ID or AD.
• Cost. Free on supported Windows, with Entra ID Free for cloud backup and Intune Plan 1 for Intune policy.
• Directory. Entra-joined devices use Entra, AD-joined devices use AD, and hybrid devices pick one.
• Settings. Defaults are 14 characters, complexity 4 and 30 days, and Microsoft highly recommends AD encryption.
• 24H2. Windows 11 24H2 adds automatic account management, passphrases and image rollback detection.

What Is Windows LAPS?

Windows LAPS (Windows Local Administrator Password Solution) is a Windows feature that manages the password of one local administrator account on each device. It backs that password up to Microsoft Entra ID or Active Directory. On domain controllers, it can also manage the Directory Services Restore Mode (DSRM) password.

Local admin accounts often share one password, and attackers use it to hop between machines. Learn lists protection against pass-the-hash and lateral-traversal attacks among the benefits, and that hop is how ransomware moves through a network. LAPS gives each device its own password and changes it on a schedule.

There's nothing to install. Windows LAPS is built in, can't be uninstalled and enforces policy the moment one applies. It costs nothing extra on supported Windows.

Windows LAPS vs Legacy Microsoft LAPS

The first LAPS was a separate Download Center MSI. Windows LAPS shipped in the Windows updates of 11 April 2023 as a separate, native rewrite.

For migrations, Windows LAPS has an emulation mode that honors your legacy Group Policy settings, as long as the legacy client-side extension isn't installed. It stores passwords in clear text with no history, so treat it as a bridge.

Supported Versions and Licensing

Newer builds have Windows LAPS out of the box. Older ones need the 11 April 2023 update or later.

Windows 10 reached end of support on 14 October 2025, so it keeps LAPS only while it still gets updates, such as through Windows 10 ESU. Server 2016 stays on legacy LAPS.

Entra ID Free covers LAPS itself, and Intune policy needs Intune Plan 1. Custom Entra roles for LAPS need Entra ID P1 or P2, and Learn says administrative units and Conditional Access carry their own license terms.

Back Up to Entra ID or Active Directory

The join state makes this call before you do. Entra-joined devices back up only to Entra ID, and AD-joined devices only to AD. Hybrid devices can use either, never both. Our Entra ID vs AD comparison covers the bigger move.

Microsoft recommends Intune for Entra-joined and Intune-enrolled hybrid devices, and Group Policy for AD-joined ones.

AD wins on features. Entra wins on access control, with roles, Conditional Access and audit logs in one portal. AD encryption needs 2016 domain functional level, and Microsoft highly recommends turning it on.

It's the same escrow idea as a BitLocker recovery key: the directory holds the secret. Delete a device from Entra and its LAPS password goes too, with no recovery unless you exported it first. A device disabled in Entra stops rotating and backing up.

In April 2026, an r/Intune admin described someone deleting thousands of active devices from Entra, which took every LAPS password with them. Top replies blame loose admin rights, and others suggest exporting passwords and keeping a second way in.

How to Set Up Windows LAPS in Intune

Entra backup through Intune takes one tenant switch and one policy, with no AD schema work.

1. In the Microsoft Entra admin center, as at least a Cloud Device Administrator, open Entra ID > Devices > Overview > Device settings (labels move). Set Enable Local Administrator Password Solution (LAPS) to Yes and save.
2. In the Intune admin center, go to Endpoint security > Account protection > Create Policy. Pick Windows and the Local admin password solution (Windows LAPS) profile. This needs the Security baselines permissions in the Endpoint Security Manager role.
3. Set Backup Directory first, because it decides which other settings appear.
4. Leave Administrator Account Name empty to manage the built-in Administrator, or name an account that already exists.
5. Assign the policy to a device group, one LAPS policy per device.
6. After the hourly cycle, check Devices > All devices > the device > Monitor > Local admin password.

In manual mode, Intune doesn't create the account, so name one that already exists. User group assignments can change the configuration whenever someone else signs in.

Every password view writes an audit event. To rotate by hand, pick Rotate local admin password from the device's menu. It isn't instant, restarts the PasswordAgeDays clock and fails if an Entra-joined device is offline. There's no bulk action.

If a technician typed the password during an Intune Remote Help session, the default post-authentication action resets it 24 hours later.

How to Set Up Windows LAPS With Group Policy

AD backup needs forest prep before the first GPO.

1. Run Update-LapsADSchema once for the forest.
2. Run Set-LapsADComputerSelfPermission on each OU of managed devices, so they can write their own passwords.
3. Run Set-LapsADReadPasswordPermission for your help desk group. Domain Admins already have read.
4. Copy LAPS.admx from %windir%\PolicyDefinitions to the Central Store by hand, because Windows Update doesn't.
5. In the Group Policy Management Console, edit a GPO at Computer Configuration > Policies > Administrative Templates > System > LAPS. Set BackupDirectory to Active Directory and keep encryption on, the default. Read rights alone don't decrypt, so name the group that may decrypt in ADPasswordEncryptionPrincipal (Domain Admins by default).
6. Force a policy run on a test device and read the password back.

This follows the cmdlet syntax on Learn, so treat it as a starting point and test it on one OU first.

powershell
Update-LapsADSchema
Set-LapsADComputerSelfPermission -Identity Workstations
Set-LapsADReadPasswordPermission -Identity Workstations -AllowedPrincipals @("contoso\LAPS Readers")
Invoke-LapsPolicyProcessing
Get-LapsADPassword -Identity PC01 -AsPlainText

Invoke-LapsPolicyProcessing runs on the managed device and is Microsoft's preferred way to skip the hourly wait. The LAPS tab in Active Directory Users and Computers shows the password and expiration and can expire it, with a LAPS-patched RSAT. Our guide shows how to install ADUC on Windows 11.

If settings come from two places, Intune's LAPS CSP beats LAPS Group Policy, which beats local configuration and legacy LAPS. Windows never mixes them.

Recommended Windows LAPS Policy Settings

Learn lists a default for every setting and a range for the numeric ones. Here's a starting point for a small IT team, with length and age left to your policy, since Microsoft publishes defaults rather than a standard.

Post-authentication actions run after someone signs in with the managed account and the delay passes. Action 1 resets the password. Action 3, the default, also signs out interactive and SMB sessions after a two-minute warning. Action 5 resets and reboots after a one-minute delay. Action 11 (24H2) does everything action 3 does and also ends remaining processes. Learn warns these can lose unsaved work, and a malicious admin holding a valid password can get around them.

What Windows 11 24H2 Adds

Everything here needs Windows 11 24H2 or Windows Server 2025 and later. Intune added the settings in the week of 17 March 2025 (service release 2503), all set to Not configured, so existing policies don't change.

Automatic Account Management

In automatic mode, LAPS creates the account, adds it to local Administrators and marks it as LAPS-controlled. Manual mode is still the default, but Microsoft recommends automatic mode in nearly all cases, with a custom account and the built-in Administrator left disabled.

The defaults lean safe: an account named WLapsAdmin that starts disabled, with an optional random six-digit name suffix. A disabled account blocks password spray and a random name is harder to target, though both add friction for your techs. Restricted Groups and LocalUsersAndGroups policies can no longer pull the account out of Administrators, and tampering attempts log events 10101-10104.

Passphrases and Readable Passwords

Complexity 6, 7 and 8 switch to passphrases from three word lists adapted from the EFF's: 7,776 long words, or 1,276 short words with or without unique prefixes. Complexity 5 drops lookalike characters such as I, O, l, 0 and 1, which helps when a tech reads a password over the phone. Neither needs Server 2025 domain controllers.

Image Rollback Detection

Restore a Hyper-V snapshot and the machine wakes up with a password AD already replaced. With each new password, LAPS writes a GUID to msLAPS-CurrentPasswordVersion and rotates at once if the local copy doesn't match. It's AD only and needs the Windows Server 2025 forest schema. That schema arrives with the first Server 2025 DC, and Update-LapsADSchema doesn't add it.

Dean Ellerby, a Microsoft MVP, walks through the new Windows LAPS features in Windows 11 24H2 in this October 2024 video. It predates the March 2025 Intune settings, so your Intune screens may differ.

Who Can Read a LAPS Password

Anyone who can read the password can sign in as admin, so keep the reader list tight.

Microsoft's LAPS documentation on Learn has the full Entra role list. Helpdesk Administrator, Security Administrator and Security Reader see metadata only, such as the last and next rotation.

If the Local admin password option is greyed out in Intune, it's a permission. Viewing or rotating the password there needs Managed devices Read, Organization Read and the Remote tasks permission Rotate Local Admin Password. No Intune built-in role includes that last one, and neither does the Entra Intune Administrator role. Build a custom role, and our guide to role-based access control covers how to scope one.

For the audit trail, open Entra ID > Devices > Overview > Audit logs and filter Activity on Update device local administrator password or Recover device local administrator password. Conditional Access can require MFA for the built-in roles that recover passwords, but not for custom or administrative unit-scoped roles. Scripts use Get-LapsAADPassword, which needs Device.Read.All plus DeviceLocalCredential.Read.All to return the password.

In AD, Learn calls Domain Admins-only decryption the safest approach. It adds that help desk access can suit frontline worker devices, with tighter limits on executive laptops. Never let a device decrypt any password, including its own.

Moving Off Legacy LAPS

Microsoft documents two paths. Immediate swaps the legacy policy for a Windows LAPS policy in one go, then removes the legacy software. Side-by-side runs both on different local accounts for a while, then removes the legacy policy, software and the extra account. The two policies can't target the same account.

Expect a rotation on day one, because devices rotate as soon as a Windows LAPS policy applies. Watch the LAPS event channel or Get-LapsADPassword, then uninstall the legacy MSI with msiexec.exe /q /uninstall {97E2CA7B-B657-4FF7-A6DB-30ECC73E1E28}.

Windows LAPS Troubleshooting

Start with Applications and Services Logs > Microsoft > Windows > LAPS > Operational, and run Get-LapsDiagnostics when the events don't explain it.

Events 10006 and 10012 point at AD prep: encryption below 2016 domain functional level, or a schema that wasn't updated.

Where Windows LAPS Stops

Windows LAPS manages one local account per device, plus DSRM on domain controllers. Point it at a different account and it stops managing the old one.

It doesn't touch domain admins, service accounts or standing admin rights. Vaulting and session control for those belong to privileged access management.

LAPS is a recovery password, and it makes a poor daily elevation tool. For users who install software all day, endpoint privilege management elevates specific apps without handing out the password.

In June 2026, an r/sysadmin admin rolling out LAPS asked what to do with six developers who need admin rights daily. Replies split between EPM or an elevation tool, a separate admin account per dev machine, a LAPS reader group and isolated VMs.

On member servers, LAPS covers the local admin account only, and our server access practice guide covers the rest.

One 2026 conflict needs a check. Microsoft lists LAPS-managed devices under when not to enable Administrator protection. Yet Windows security baselines for Windows 11 24H2, 25H2 and 26H2 turn it on by default with the October 2026 security update. Review it for LAPS-managed devices.

LAPS is Windows only in Entra, and Intune handles Mac local admin accounts with a separate feature.

For the rest of the device stack, OpenFrame is open, AI-native infrastructure for IT and security. It covers large areas of RMM, patching, MDM and documentation, with Fae resolving support requests and Mingo running IT operations. It costs $1 per device per month, with a 14-day free trial. Flamingo builds OpenFrame, which doesn't manage local admin passwords, so LAPS keeps that job.

Windows LAPS in Short

Windows LAPS gives every Windows device its own local admin password, rotates it and backs it up to Entra ID or AD. Let the join state pick the directory, keep one policy per device, encrypt in AD and move 24H2 devices to automatic account management. Then keep the reader list short and check the audit log. To swap the admin account on a single PC, see how to change the administrator on Windows 11.