Windows LAPS: Rotating Local Administrator Passwords Safely

Reusing one local administrator password across Windows devices turns a credential recovered from one endpoint into a lateral-movement tool. Windows Local Administrator Password Solution, or Windows LAPS, generates a different password on each managed device, rotates it on policy, and backs it up to an authorized directory.

The modern feature is built into supported Windows releases that received the April 11, 2023 update or later. It is separate from the legacy Microsoft LAPS MSI, which is deprecated on newer systems. A deployment should choose the native feature and remove ambiguity about which policy source is active.

Choose one backup directory

Device join state determines the available destination. Microsoft Entra joined devices back up to Microsoft Entra ID. Active Directory domain-joined devices back up to Windows Server Active Directory. Hybrid-joined devices can use either, but Windows LAPS does not back up one managed password to both destinations.

For Active Directory, first update the schema with the Windows LAPS cmdlets, delegate computer self-permission to write its password attributes, and grant password-read rights only to a small recovery group. For Entra ID, use roles or custom permissions that separate reading LAPS metadata from reading the clear-text password.

Do not grant every help-desk operator a broad directory role just to recover one endpoint. Test the exact retrieval identity against an in-scope device and an out-of-scope device.

Decide which local account is managed

Windows LAPS manages one local administrator account at a time. On Windows 11 24H2 and later, automatic account management can create or manage a custom account, control its enabled state, and randomize its name. Earlier supported clients need the specified account to exist already.

Renaming an administrator account is not a substitute for password rotation. Choose a dedicated account name, document whether it may be used for remote logon, and use policy to deny network or Remote Desktop access where the recovery scenario does not require it.

Set password length and age according to operational exposure. A very short age increases directory writes and recovery churn without fixing overbroad read permissions. A very long age extends the usefulness of a disclosed credential. Rotation after authentication is often more important: the post-authentication action can reset the password after a grace period and optionally log off or shut down the session.

Encrypt Active Directory backups

Windows LAPS can encrypt passwords stored in Active Directory and maintain encrypted password history. Microsoft recommends enabling encryption. Select an ADPasswordEncryptionPrincipal that represents the recovery operators; if several teams need access, use a controlled group rather than trying to assign several encryption principals.

Encryption does not repair weak authorization around that group. Audit membership, protect privileged workstations used for recovery, and avoid copying recovered passwords into tickets or chat. Password history is for recovery from directory or machine rollback, not a source of reusable emergency credentials.

Domain Controller DSRM passwords can also be managed and backed up to Active Directory when encryption is enabled. They cannot be backed up to Entra ID. Test that procedure separately from client LAPS because it belongs to an Active Directory disaster-recovery plan.

Apply and force a scoped policy cycle

Configure Windows LAPS through Group Policy, the LAPS configuration service provider, or Intune. Avoid conflicting roots. After policy reaches a test device, run the scoped processor instead of waiting for the normal background cycle:

Invoke-LapsPolicyProcessing
Get-LapsDiagnostics

Windows LAPS normally processes policy in a background task that wakes hourly. Reset-LapsPassword requests an immediate local rotation. Confirm three states after the test: the local password changed, the new value and expiration were backed up to the intended directory, and an authorized operator can retrieve it.

Then attempt retrieval with an unauthorized identity. A successful rotation with public read access is a failed deployment.

Monitor rotation and torn state

Use the dedicated Windows LAPS event log and directory or Intune reporting to watch policy processing, backup, retrieval, and rotation failures. Alert on devices whose expiration passes without a newer backup, not merely on the presence of any LAPS attribute.

Virtual-machine snapshot rollback can restore an old local password while the directory contains a newer one. Windows LAPS records a password-version GUID and can detect that torn state during processing, then rotate again. Still test snapshot restore and offline-device scenarios for the platforms you operate.

Finally, rehearse recovery. Take a test endpoint off the corporate network, retrieve its password through the approved workstation and role, sign in locally, complete the repair, reconnect it, and force rotation. The workflow is complete only when the exposed recovery password is no longer valid.

Migrate from legacy LAPS without two owners

Windows LAPS is a native implementation, not an in-place update of the older Microsoft LAPS MSI. It can emulate legacy behavior to help a staged migration, but the endpoint should never have two password processors competing for the same account and directory attributes.

Inventory legacy client-side extensions, Group Policy objects, schema attributes, retrieval tools, delegated readers, and automation before enabling native policy. Choose a pilot organizational unit, verify that the built-in Windows LAPS client is present, and decide whether the pilot temporarily uses emulation or moves directly to the new schema and backup directory. Preserve an explicit rollback boundary instead of applying both policy families broadly.

During the pilot, compare event logs and directory writes from one endpoint. Confirm which processor owns rotation, which account it manages, where the value is backed up, and which retrieval command returns it. Remove the legacy client extension and obsolete policy only after the native password has rotated and an authorized recovery operator has tested it.

Finish by searching for stale legacy passwords and permissions. A new encrypted Windows LAPS value does not erase an older clear-text attribute or revoke groups that could read it. Retire old retrieval scripts, narrow unused ACLs, update help-desk instructions, and alert on any device that continues writing through the legacy path. Migration succeeds when there is one policy owner, one documented recovery source, and no reusable predecessor credential left behind.

Related:

Sources: