Microsoft LAPS is a Windows security feature that automatically manages local administrator passwords on domain-joined devices. It generates unique passwords, stores them securely in directory services, and rotates them on a schedule, reducing password reuse and limiting lateral movement if one endpoint is compromised.
What Microsoft LAPS Changes in Windows Administration
Microsoft LAPS reduces a long-standing administrative weakness in Windows estates, shared or reused local administrator passwords. By giving each device its own managed local admin secret, it narrows the blast radius of an endpoint compromise and makes privilege reuse much harder.
This is less about convenience than about breaking a common attack path. When local administrator credentials are identical across many machines, one stolen password can become a pivot into many systems; LAPS removes that shared credential pattern and turns each endpoint into a separate trust boundary.
How Microsoft LAPS Works in Practice
LAPS is designed for domain-joined Windows devices and works by generating a unique local administrator password for each managed endpoint, storing it in directory services, and rotating it on a schedule. That means the password can be retrieved for legitimate support only when needed, rather than being broadly known or manually maintained.
In modern deployments, the operational details matter as much as the password itself. Access to read the stored password must be tightly scoped, because the security value of LAPS depends on preventing routine exposure of the recovery path.
For deployment and migration guidance, the Local Administrator Password Solution (LAPS) Guide covers the move from legacy LAPS, backup options, read permissions, rotation, and misuse detection.
Why LAPS Matters for Privilege and Lateral Movement
Local administrator accounts are especially dangerous when they are predictable, static, or reused. Once an attacker gains admin-level access on one endpoint, the next step is often credential harvesting, reuse, or lateral movement into adjacent systems. LAPS limits that progression by ensuring the compromised password is usually valid for only one device.
That does not eliminate endpoint compromise, but it changes the attacker’s economics. Instead of one password unlocking many hosts, the attacker must obtain and use access per machine, which increases friction, reduces reach, and improves the defender’s ability to contain a breach.
When Microsoft LAPS Requires Careful Governance
LAPS is only effective when organisations treat password retrieval, directory permissions, and device coverage as part of access governance. If too many people can read local admin passwords, or if unmanaged endpoints remain outside the policy, the control weakens quickly.
It also needs to fit into broader password hygiene. The Password Security and Password Manager Guide is useful context for the wider problem of reused credentials, rotation, and password policy discipline that LAPS is meant to reduce.
Microsoft LAPS should be viewed as a compensating control for a specific administrative risk, not as a substitute for least privilege, endpoint hardening, or better privileged-access design.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST SP 800-57 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | LAPS manages local admin passwords across endpoints. |
| AC-6 — Least Privilege | LAPS reduces standing reuse of powerful local admin credentials. | |
| AU-2 — Event Logging | LAPS use and password retrieval should be auditable. | |
| Recommendation — Automate password rotation and protect retrieval paths for managed local administrator credentials. Restrict local administrator access to the minimum needed and limit who can retrieve passwords. Log password reads and administrative use to support misuse detection and review. | ||
| CIS Controls v8 | CIS-5 — Account Management | LAPS governs local administrator account exposure and lifecycle. |
| Recommendation — Centralise and rotate local administrator credentials instead of allowing shared static passwords. | ||
| NIST SP 800-57 | Key Management | LAPS reflects lifecycle control over sensitive access material. |
| Recommendation — Apply lifecycle discipline to sensitive local admin credentials, including rotation and controlled access. | ||