LAPS Guide: Windows LAPS Deployment and Permissions

When every Windows device shares the same local administrator password, one compromised laptop gives an attacker administrator access to the whole fleet. The Local Administrator Password Solution (LAPS) fixes this by giving each device a unique, rotated password that is backed up to the directory, but a LAPS deployment is only as safe as the people who can read those passwords. Windows LAPS, built into Windows since the April 2023 updates, replaced the legacy Microsoft LAPS product with encryption, password history, Entra ID backup, DSRM backup and post-authentication rotation. This guide is for endpoint, directory and privileged access teams planning a deployment, a migration from legacy LAPS or a permissions review. For the wider directory programme see the Active Directory and Entra ID Hardening Guide.

Key takeaways

• Unique passwords stop lateral reuse. MITRE ATT&CK notes that implementing LAPS "may also help prevent reuse of local administrator credentials across a domain."
• Legacy LAPS is deprecated. Microsoft deprecated the legacy product from Windows 11 23H2, newer Windows versions block its installer, and its clear-text ms-Mcs-AdmPwd attribute should be retired.
• Read rights are the real control. Anyone who can read the LAPS attributes on an OU, including through "All extended rights", holds admin on every device in it.
• Encrypt in Active Directory. With a Windows Server 2016 domain functional level, Windows LAPS encrypts the password to one principal and keeps an encrypted history.
• Rotate after use. Post-authentication actions reset the password, and can sign out or reboot, after the account is used, which limits how long a retrieved password stays valid.

Why shared local administrator passwords are dangerous

Imaged builds often carry the same local administrator account and password to every device. ATT&CK T1078.003 Valid Accounts: Local Accounts records that "password reuse may allow the abuse of local accounts across a set of machines on a network", and T1550.002 Pass the Hash shows that an attacker does not even need the clear-text password: the hash taken from one device authenticates to the next. Microsoft lists "protection against pass-the-hash and lateral-traversal attacks" as the first benefit of Windows LAPS. A unique password per device turns a single-device compromise back into a single-device problem. For how attackers harvest those hashes see the Credential Dumping Guide, and for how they move with them the Lateral Movement Guide.

The local administrator account is also a non-human-style credential problem: it is shared, it is not tied to a person, and it is often used by support staff and scripts. LAPS turns it into a managed secret with an owner, an audit trail and a rotation schedule.

Windows LAPS compared with legacy Microsoft LAPS

Microsoft states that "the legacy Microsoft LAPS product is deprecated as of Windows 11 23H2 and later" and that it "no longer considers code changes" for it. Legacy LAPS keeps working on older Windows versions until their own end of support.

Choosing where to back up the password

• Microsoft Entra ID (BackupDirectory = 1): for Entra-joined devices, and an option for hybrid-joined devices. Turn on Enable Local Administrator Password Solution (LAPS) in Entra ID device settings first. Available with Entra ID Free. Access is controlled by Entra roles. Workplace-joined devices are not supported.
• Windows Server Active Directory (BackupDirectory = 2): for domain-joined and hybrid-joined devices and the only target for DSRM passwords, encryption, password history and image rollback detection.

Small organisations that are cloud-first usually back up to Entra ID through Intune and rely on built-in roles. Large hybrid estates tend to keep servers and domain controllers on AD with encryption and history, and move Entra-joined clients to Entra ID, with a separate read model for each.

LAPS policy settings that matter

Windows LAPS reads policy from four roots and uses the first that has any setting defined: the LAPS CSP (Intune), then Group Policy, then local configuration, then legacy LAPS policy. Settings never merge across roots, and Microsoft's Intune documentation confirms the CSP-based policy "overrides all other sources of LAPS policy."

If AdministratorAccountName is not set, Windows LAPS manages the built-in Administrator identified by its RID. Windows LAPS does not create custom accounts unless automatic account management is enabled, and Intune "supports only one account per device". Two policies naming different accounts conflict.

LAPS permissions: who can read the password

LAPS read permissions are the security boundary. Microsoft describes three layers on the AD side: rights to read or set the expiration time (sensitive but "nondestructive"), rights to read the password attributes, and, with encryption, rights to decrypt. For the last two the guidance is that "the most secure approach is to reserve this level of permission for members of the Domain Admins group." In practice most organisations delegate reading to a help desk group per tier, which is acceptable if that group is small, uses dedicated accounts and is audited.

The hidden risk is "All extended rights" (Control Access) on computer OUs. Microsoft warns that users with that permission "can read confidential attributes, and all the Windows LAPS password attributes are marked as confidential." Legacy deployments often granted it to desktop support years ago, and it still lets them read msLAPS-Password and ms-Mcs-AdmPwd. Run Find-LapsADExtendedRights against every OU and remove anything beyond SYSTEM and the intended groups. Treat LAPS readers as privileged identities. See the Privileged Access Management Guide.

A safe retrieval workflow

• Tiered reader groups: separate groups for workstations, member servers and domain controllers, applied per OU, so a workstation support account can never read a server password.
• Just-in-time membership: grant reader group membership for a ticket and remove it automatically, or have a PAM vault retrieve the password on the engineer's behalf. See the JIT Access Guide.
• Retrieve from a clean device: read passwords only from a privileged access workstation or hardened support host, never from the user's possibly infected machine.
• Use once: rely on post-authentication actions so the password changes shortly after the support session ends.

Beyond LAPS: limiting what the local administrator can do

LAPS makes the password unique; it does not stop a valid password or hash being used remotely, and it does not remove local administrator rights from ordinary users. Three complementary controls close most of the gap.

• Deny network logon for local accounts: assign the well-known group "Local account and member of Administrators group" (S-1-5-114) to the user rights "Deny access to this computer from the network" and "Deny log on through Remote Desktop Services" on workstations, so the local administrator can only be used at the console or through managed tooling.
• Keep UAC remote restrictions on: leave LocalAccountTokenFilterPolicy at its default so remote connections by local administrator accounts receive a filtered token. ATT&CK lists User Account Control (M1052) as a mitigation for pass the hash.
• Remove standing local admin rights from users: elevation on demand reduces how often anyone needs the LAPS account at all. See the Endpoint Privilege Management Guide.

Test the network logon restriction in a pilot ring first: some legacy management agents and deployment tools still connect with the local administrator account, and those dependencies are worth finding and replacing.

Rotation, post-authentication actions and recovery

• Scheduled rotation: each device rotates when PasswordAgeDays expires. PasswordExpirationProtectionEnabled (default on) stops a device keeping a password longer than policy allows.
• On-demand rotation: Reset-LapsPassword on the device, the CSP ResetPassword action (the Intune "Rotate local admin password" device action), or expiring the password in AD with Set-LapsADPasswordExpirationTime, which the device acts on at its next hourly cycle.
• Post-authentication actions: when the managed account is used, Windows LAPS schedules a reset after the grace period, which "is intended to bound the amount of time that the clear-text password is usable." Action 3 also signs the session out; 5 reboots after one minute; 11 ends remaining processes running as the account.
• Image rollback detection: restoring a VM snapshot can bring back a password that no longer matches the directory. On Windows 11 24H2 and Windows Server 2025 with the 2025 forest schema, LAPS compares a GUID in msLAPS-CurrentPasswordVersion and rotates immediately on mismatch.
• Blocking other managers: Windows LAPS rejects attempts by other tools to change the managed account's password (event 10031), so do not run two products against one account.

DSRM password backup

Every domain controller has a Directory Services Restore Mode account whose password is set at promotion and rarely changed. With ADBackupDSRMPassword enabled, Windows LAPS manages and backs it up to msLAPS-EncryptedDSRMPassword, with optional history in msLAPS-EncryptedDSRMPasswordHistory. Requirements: password encryption enabled, DFL 2016 or later and domain controllers on Windows Server 2019 or later. DSRM passwords cannot go to Entra ID and post-authentication actions do not apply. The password can also be recovered from a mounted AD backup, which matters in forest recovery. See the Identity Recovery Guide.

Migrating from legacy LAPS and rolling out Windows LAPS

1. Prepare AD. Run Update-LapsADSchema, confirm DFL 2016 for encryption, create reader, expirer and decryptor groups, and apply Set-LapsADComputerSelfPermission and read permissions per OU.
2. Clean up rights first. Run Find-LapsADExtendedRights on every OU and remove stray "All extended rights" grants, which expose both old and new attributes.
3. Pilot ring. Apply a Windows LAPS policy to a test OU or Intune group. The first application rotates the password immediately. Confirm event 10018 (AD) or 10029 (Entra ID) and retrieve with Get-LapsADPassword or Get-LapsAADPassword.
4. Choose a migration path. Microsoft documents an immediate transition (remove the legacy policy and apply the Windows LAPS policy at the same time, targeting the same account) and a transient side-by-side approach using a second local account, because both products may not manage the same account.
5. Use emulation mode only as a bridge. Without a Windows LAPS policy and without the legacy client side extension installed, Windows LAPS honours legacy policy in "legacy Microsoft LAPS emulation mode", still writing clear text to ms-Mcs-AdmPwd. It cannot encrypt or back up to Entra ID.
6. Remove legacy LAPS. Uninstall the MSI (or unregister AdmPwd.dll) once devices report Windows LAPS success, then clear stale ms-Mcs-AdmPwd values so old passwords stop being readable.
7. Roll back by removing the Windows LAPS policy from the pilot scope and restoring the legacy policy, which only works while the legacy software is still installed, so keep it until the pilot ring is stable. A Windows LAPS policy, when present, always wins.

Intune-managed devices get the same settings through an Endpoint security account protection policy (LAPS profile); because the CSP wins, do not leave a conflicting Group Policy LAPS policy on the same devices. For broader endpoint baselines see the Windows Endpoint Hardening Guide.

LAPS auditing and detection

Alert on password reads by accounts outside the reader groups, bulk reads across many devices in a short period, and network logons with the local administrator account from devices that are not support jump hosts. See the Windows Event Log Guide.

• Coverage: percentage of Windows devices with a LAPS password backed up within PasswordAgeDays; target above 98.
• Legacy exposure: computer objects with a non-empty ms-Mcs-AdmPwd; target zero after migration.
• Reader population: accounts able to read or decrypt LAPS passwords, per tier; trend down.
• Read to rotation time: median hours between a password read and its next rotation; with post-authentication actions this should match the reset delay.
• Failures: devices logging 10005 or 10043 in the last week.

Common failure patterns

• Extended rights left behind: a support group with "All extended rights" on a top-level OU can read every password, and nobody re-checked after deploying Windows LAPS.
• Clear text kept forever: devices migrated but ms-Mcs-AdmPwd values were never cleared, so old passwords remain readable and some still work on devices that missed rotation.
• Decryptor is Domain Admins by default: help desk staff are added to Domain Admins to read passwords, widening tier zero.
• Policy silently disabled: BackupDirectory left at 0 or a GPO overridden by an empty Intune profile, so devices report success on nothing.
• Servers excluded: LAPS covers clients but servers, including management servers, keep a shared build password.
• Passwords used and never rotated: post-authentication actions disabled, so a password read during an incident stays valid for 30 days.

Framework mapping

Practitioner checklist

• Deploy Windows LAPS to every Windows client and server, with BackupDirectory set explicitly.
• Remove legacy LAPS and clear stale ms-Mcs-AdmPwd values after migration.
• Enable AD password encryption with a dedicated decryptor group and keep a small encrypted history.
• Run Find-LapsADExtendedRights on all OUs and remove unintended extended rights.
• Scope Entra ID password read with administrative units and protect built-in roles with Conditional Access.
• Enable post-authentication actions with a short grace period.
• Back up DSRM passwords on domain controllers running Windows Server 2019 or later.
• Audit password reads in AD and Entra ID and alert on unusual or bulk reads.
• Track LAPS coverage and failures weekly.

Standards and references

• Microsoft Learn: What is Windows LAPS?
• Microsoft Learn: Configure policy settings for Windows LAPS
• Microsoft Learn: Windows LAPS concepts overview
• Microsoft Learn: Migrate from legacy Microsoft LAPS to Windows LAPS
• Microsoft Learn: Windows LAPS in Microsoft Entra ID
• Microsoft Learn: Microsoft Intune support for Windows LAPS
• Microsoft Learn: Windows LAPS event log
• MITRE ATT&CK: T1078.003 Valid Accounts: Local Accounts

Related NHI Mgmt Group resources: Active Directory and Entra ID Hardening Guide · Password Security Guide · Privileged Access Management Guide · Endpoint Privilege Management Guide