Windows LAPS: Cloud-Native Local Admin Solution

Deploy and configure Windows Local Administrator Password Solution (LAPS) with Microsoft Entra ID and Intune for automated password rotation, encryption, and recovery.

Tags:#Windows LAPS#Entra ID#Security#Endpoint Security#Local Admin#MD-102

Overview

Windows Local Administrator Password Solution (Windows LAPS) natively integrated into Windows 10/11 automatically rotates local administrator passwords, enforces complexity policies, and backs up credentials encrypted directly into Microsoft Entra ID.

This mitigates the critical risk of lateral movement attacks (Pass-the-Hash) caused by sharing identical static local administrator passwords across multiple corporate endpoints.

---

When to Use

Scenario	Recommendation	Technical Rationale
Entra Joined Field Laptops	Mandatory	Eliminates uniform local admin credentials while guaranteeing emergency offline recovery.
Retire Legacy LAPS	Highly Recommended	Modern LAPS is built into the Windows kernel; no third-party agents or legacy AD schema required.

---

Prerequisites

OS Builds: Windows 11 (21H2+) or Windows 10 (20H2+) with April 2023 cumulative updates or later.
Entra Feature Flag: Enable Azure AD LAPS in Entra Admin Center.
Required Role: Global Administrator, Cloud Device Administrator, or custom role with microsoft.directory/deviceLocalCredentials/password/read.

---

Portal Path

TEXT

Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Endpoint security
    └── Account protection
        └── Create Policy
            ├── Platform: Windows 10 and later
            └── Profile: Local admin password solution (Windows LAPS)

---

Step-by-Step Implementation

Step 1: Enable LAPS in Microsoft Entra ID

Navigate to Microsoft Entra Admin Center (entra.microsoft.com).
Go to Identity > Devices > All devices > Device settings.
Set Enable Azure AD Local Administrator Password Solution (LAPS) to Yes.

Step 2: Configure LAPS Policy in Intune

In Intune Admin Center > Endpoint security > Account protection > Create policy.
Configure settings:

Backup directory: Backup the password to Azure AD only
Password Age Days: 30
Administrator Account Name: Custom admin name (e.g., LapsAdmin) or manage built-in Administrator.
Password Complexity: Large letters + small letters + numbers + special characters
Post Authentication Actions: Reset the password and logoff the managed account
Post Authentication Reset Delay: 2 (hours)

---

PowerShell Commands

Retrieve LAPS Password via Microsoft Graph SDK:

PowerShell

Connect-MgGraph -Scopes "DeviceLocalCredential.Read.All"

# Query LAPS credentials for specific device
$DeviceName = "CORP-PC-01"
$Device = Get-MgDevice -Filter "displayName eq '$DeviceName'"
Get-MgDeviceLocalCredential -DeviceId $Device.Id | Select-Object -ExpandProperty Credentials

Inspect LAPS Events Locally in Event Viewer:

PowerShell

# Read recent LAPS events
Get-WinEvent -LogName "Microsoft-Windows-LAPS/Operational" -MaxEvents 10 | 
    Select-Object TimeCreated, Id, Message | 
    Format-List

---

Troubleshooting Matrix

Error	Root Cause	Resolution
Event ID 10011 (LAPS failure)	Device failed to escrow password to Entra ID due to network or registration issue.	Verify device join status via `dsregcmd /status` and check connectivity to `login.microsoftonline.com`.
Account Not Found	The specified custom administrator account name does not exist on the machine.	Ensure the local account is provisioned prior to policy enforcement, or configure LAPS to manage built-in Administrator.

---

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

Key Exam Takeaways:

Modern Windows LAPS supports two backup targets: Active Directory (on-prem) or Microsoft Entra ID (cloud).
Post Authentication Action resets the local administrator password automatically after a specified grace period following administrative use.

PREVIOUS TOPIC2.4 Device Identity: Entra Joined vs Hybrid vs Registered NEXT TOPIC3.2 BitLocker Silent Disk Encryption & Key Escrow