How to Enable Windows LAPS in Active Directory

1.3K

This article explains how to enable and configure LAPS for Windows 11 client workstations in an Active Directory environment.

Windows LAPS Overview

The Local Administrator Password Solution (LAPS) feature in Microsoft networks is used to automatically manage and securely store (backup) passwords for local administrator accounts on computers joined to on-premises Active Directory domains or Microsoft Entra ID (formerly Azure AD).

After configuring the LAPS component on each workstation, it will generate a unique, random password for the built-in local admin account on each domain-joined machine. This password can then be stored in AD/Entra ID and updated regularly. This ensures that local admin passwords on domain-joined machines remain unique, which mitigates the risk of lateral movement if a password or its hash is compromised on a single system. Our article focuses on deploying Windows LAPS with Windows Server Active Directory. For Microsoft Entra-joined devices, Microsoft recommends managing Windows LAPS through Microsoft Intune using the Windows LAPS CSP.

Windows LAPS can also manage the Directory Services Restore Mode (DSRM) account password on Windows Server DCs. Note that DSRM password backup is supported only when passwords are encrypted and stored in Windows Server AD.

Prior to the introduction of Windows LAPS in the April 2023 security updates, admins had to deploy the Legacy Microsoft LAPS MSI package, known as Legacy LAPS. The modern Windows LAPS component is integrated into newer Windows 11 releases and does not require manual installation.

Note that legacy Microsoft LAPS is deprecated and you should not use it for new deployments. In case your organization is already use Legacy LAPS, you should plan a migration to Windows LAPS rather than continuing to deploy the legacy MSI package.

Windows LAPS supports two approaches to managing local administrator accounts:

• Manual account management — Windows LAPS manages an existing local admin account. If you specify AdministratorAccountName, that account must already exist.
• Automatic account management — supported on Windows 11 24H2 and later and Windows Server 2025 and later. Windows LAPS can automatically manage the local admin account instead of requiring admins to pre-create and maintain the account.
  On Windows 11 24H2 and Windows Server 2025 or later, Windows LAPS adds several new policy options, including automatic account management, passphrase-based passwords, additional password complexity modes, and enhanced post-authentication actions. Keep in mind that these settings are not available on earlier Windows versions.

The remainder of our article uses the traditional/manual account-management model unless otherwise noted.

Windows LAPS deployment options

Device type	Recommended management	Password backup
AD joined	Group Policy	Windows Server AD
Microsoft Entra joined	Intune/Windows LAPS CSP	Microsoft Entra ID
Hybrid joined + Intune	Intune/Windows LAPS CSP	AD or Entra ID, depending on config

Setup Prerequisites for Windows LAPS in AD

• Minimum Active Directory Domain Functional Level — Windows LAPS can store passwords in AD on domains with a DFL below 2016, but password encryption and DSRM password management require Windows Server 2016 DFL/later. Windows Server 2019/later DCs are required for DSRM password management.
• Supported operating systems: Windows 11 and 10; Windows 2025, 2022, 2019 with the April 11 2023 update. Note that Windows Server 2016 Domain Functional Level is supported for Windows LAPS password encryption, but Windows Server 2016 itself does not support Windows LAPS. Some newer LAPS features (including Automatic Account Management) require Windows 11 24H2 or later/Windows Server 2025 or later.

How to Enable Windows LAPS in Active Directory

To enable Windows LAPS support in Active Directory, the AD schema must be extended by adding LAPS attributes. To do this, sign in to the AD domain controller with an account that is a member of the Schema Admins and Enterprise Admins group. Open an elevated PowerShell prompt and run the command:

Update-LapsADSchema -Verbose

Now check if the msLAPS-Password schema attribute exists before continuing:

Get-ADObject `
-SearchBase (Get-ADRootDSE).SchemaNamingContext `
-LDAPFilter "(lDAPDisplayName=msLAPS-Password)"

After updating the schema, run the ADUC console (dsa.msc) and open the properties of any computer object. Verify that a new LAPS tab has appeared and that new attributes beginning with msLAPS-* have been added to the Attributes Editor of a computer object.

Update LAPS attributes

Computer accounts require delegated permissions on their LAPS attributes in Active Directory to write and update their LAPS-managed password attributes. Specify the distinguishedName of the Organizational Unit (OU) containing the computer accounts authorized to update their LAPS attributes:

Set-LapsADComputerSelfPermission -Identity "OU=Workstations,OU=HQ,DC=theitbros,DC=com"

Granting read and reset permissions for LAPS passwords

Run the following command to grant read and reset permissions to members of the HQ_HelpDesk security group for LAPS passwords on computers in the specified OU:

Set-LapsADReadPasswordPermission -Identity "OU=Workstations,OU=HQ,DC=theitbros,DC=com" -AllowedPrincipal "THEITBROS\HQ_HelpDesk"

You need to follow the principle of least privilege when delegating LAPS access. The HQ_HelpDesk group should contain only authorized Help Desk operators who need to retrieve local admin passwords for supported recovery/troubleshooting case. You should not grant LAPS password access to broad groups such as Domain Admins, all IT staff, or all Help Desk users unless their job responsibilities require it.

Note that you should delegate password read and password reset permissions separately where possible. Users who only need to retrieve a LAPS password should not automatically receive permission to force password rotation.

In order to allow Help Desk operators to force a password rotation for managed local admin accounts, you should delegate the LAPS password reset permission:

Set-LapsADResetPasswordPermission `
-Identity "OU=Workstations,OU=HQ,DC=theitbros,DC=com" `
-AllowedPrincipal "THEITBROS\HQ_HelpDesk"

In order to check which users and groups have delegated Windows LAPS permissions on the OU, run the command:

Find-LapsADExtendedRights `
-Identity "OU=Workstations,OU=HQ,DC=theitbros,DC=com"

Configuring Windows LAPS Group Policy Settings

To enable LAPS for domain workstations, configure a GPO with LAPS settings and link it to the OU containing the target computer accounts:

1. Open the Group Policy Management console (gpmc.msc) and create a new GPO.
2. Switch to policy editing mode.
3. Navigate to Computer Configuration > Policies > Administrative Templates > System > LAPS. This GPO section contains LAPS settings that can be configured.

   

Note. If the LAPS policy section is missing, you should check if the latest Windows administrative templates are installed in your organization’s Central Store. The LAPS policy templates are provided as part of the Windows administrative templates. You should update the Central Store from a supported Windows installation/obtain the current ADMX/ADML templates from Microsoft.

Enable and configure the following GPO options:

• Configure password backup directory — Active Directory
• Password Settings — Configure the password length, complexity, and change frequency. Windows 11 24H2 and Windows Server 2025 also support additional PasswordComplexity values (5–8) and passphrase-based passwords using PassphraseLength.
  Windows 11 24H2 and Windows Server 2025 introduce additional PasswordComplexity values from 5 through 8. These modes are designed to improve password readability by progressively restricting difficult-to-distinguish characters and character combinations. The new values are supported only on Windows 11 24H2, Windows Server 2025, and later releases.
  Also, Windows 11 24H2 and Windows Server 2025 introduce support for passphrase-based LAPS credentials. Instead of generating a conventional character-based password, Windows LAPS can generate a passphrase consisting of multiple randomly selected words.
  The number of words is controlled by the PassphraseLength policy setting. The default is six words, and the supported range is three to ten terms.
  For Help Desk and account-recovery cases, you should consider using LAPS passphrases instead of highly complex character-based passwords on supported Windows 11 24H2 and Windows Server 2025 devices. Passphrases can be easier for support staff to read, communicate, and enter manually while still providing strong entropy when generated randomly by Windows LAPS.
• Enable Password Encryption — Encrypts Windows LAPS passwords before storing them in AD. This setting is required for DSRM password management and encrypted password history. In case you are working with production environment, we recommend using password encryption and restricting password decryption to authorized security principals. Password encryption is not required for Windows LAPS to function, but it is strongly recommended for production AD environments.
  Keep in mind that Windows LAPS password encryption in AD requires a KDS root key. Before enabling this policy, you need to ensure that a KDS root key exists and is effective on the DCs.
  Note. In a newly deployed AD environment, a newly created KDS root key normally requires approximately 10 hours before it becomes effective. This delay helps you to prevent replication-related security issues. As a result, Windows LAPS password encryption may not work immediately after you created the KDS root key.
  In a single-DC lab or test environment, you can create the KDS root key with:

  Add-KdsRootKey -EffectiveImmediately

  This option makes the KDS root key immediately effective for the local DC. You should not use -EffectiveImmediately in a production multi-DC environment simply to bypass the normal KDS propagation delay. The normal delay provides time for the root key to replicate between DCs and helps prevent replication-related security issues.
  If you are working with production environment, allow the KDS root key to become effective through the normal process before relying on it for Windows LAPS password encryption.
• Back up DSRM account password — enables Windows LAPS to back up the Directory Services Restore Mode (DSRM) account password of DCs to Active Directory. Note that this option applies to Windows Server DCs and requires password encryption to be enabled.
• Configure authorized password decryptor — Specifies the user/security group that is allowed to decrypt encrypted Windows LAPS passwords stored in AD.
• Name of administrator account to manage (optional) — Use this if you want to manage the password for an account other than the built-in Administrator account.
• Post-Authentication actions (optional) — Allows you to set an action that is triggered when someone uses the LAPS password. For example, setting 8 hours here will enable automatic password reset, and optionally enforce logoff of the LAPS-managed account after a configurable grace period.
  Windows 11 24H2 and Windows Server 2025 also support the value 11 for PostAuthenticationActions. This value enables the enhanced post-authentication behavior: Windows LAPS resets the managed account password, terminates interactive sign-in sessions and SMB sessions that use the managed account, and terminates remaining processes running under the managed account identity.
  Note that PostAuthenticationActions = 11 does not enable Automatic Account Management. Automatic Account Management is enabled separately through AutomaticAccountManagementEnabled. When using Automatic Account Management on supported Windows 11 24H2 and Windows Server 2025/later devices, you need to config AutomaticAccountManagementEnabled together with the other Automatic Account Management settings as required. PostAuthenticationActions controls what happens after the LAPS password is used; keep in mind that it does not control whether Automatic Account Management itself is enabled.
  You should use PostAuthenticationActions = 11 only after testing it in your environment, because terminating processes running under the managed account can interrupt apps/result in data loss.

All that remains is to link the GPO to the appropriate OU with Windows 11 workstations to enable LAPS password management for them.

Windows LAPS with Microsoft Entra ID and Intune

Step 1 — Enable LAPS in Entra ID

For Microsoft Entra-joined devices, Windows LAPS can back up local administrator passwords to Microsoft Entra ID. Before deploying the Intune policy, make sure Windows LAPS is enabled for your tenant in the Microsoft Entra admin center.

In the Microsoft Entra admin center, go to Identity > Devices > Overview > Device settings and enable Local Administrator Password Solution (LAPS).

Step 2 — Intune policy

In the Microsoft Intune admin center, go to Endpoint security > Account protection > Create Policy.

Select:

• Platform: Windows
• Profile: Local admin password solution (Windows LAPS)

Configure the policy settings according to your organization’s password and local account requirements, and assign the policy to the appropriate device group.

Step 3 — Backup Directory

In the Windows LAPS policy, set Backup Directory to Microsoft Entra ID.

When configured through the Windows LAPS CSP, Microsoft Entra ID is represented by:

BackupDirectory = 1

This instructs Windows LAPS to back up the managed local administrator password to Microsoft Entra ID instead of Windows Server Active Directory.

Depending on your deployment requirements, configure settings such as:

• Password age
• Password complexity
• Password length
• Administrator account name
• Post-authentication actions
• Post-authentication reset delay

Automatic account management

On supported Windows 11 24H2 and Windows Server 2025 or later devices, Windows LAPS can automatically manage the local administrator account. This can eliminate the need to pre-create and maintain a dedicated local administrator account.

Automatic Account Management also provides protection against tampering with the managed local account. Windows LAPS can detect certain unauthorized changes to the managed account and take corrective action during the next policy processing cycle. This helps prevent an attacker or adminr from modifying the managed account in a way that would interfere with LAPS password management.

If you use Automatic Account Management, configure the corresponding settings in the Intune Windows LAPS policy instead of relying on a pre-existing local administrator account.

Step 4 — Assignment

Assign the Windows LAPS policy to the appropriate Microsoft Entra device group. Avoid assigning conflicting LAPS configurations through multiple management mechanisms unless you have explicitly designed and tested the resulting policy precedence.

In hybrid environments, avoid unintentionally configuring the same LAPS settings through both Group Policy and Intune. Document which management platform is authoritative for each device group.

Step 5 — Retrieve the Windows LAPS password

For Microsoft Entra-backed Windows LAPS deployments, authorized administrators can retrieve the local administrator password from the Microsoft Entra device object using the appropriate Microsoft Entra/Intune administrative interface and permissions.

Access to LAPS credentials should be restricted using least-privilege Microsoft Entra roles and permissions.

AD and Microsoft Entra ID differences

How to Manage DSRM Passwords with Windows LAPS

Note. DSRM password management applies to Windows Server Active Directory DCs. It is not available when Windows LAPS uses Microsoft Entra ID as the password backup directory.

With the help of Windows LAPS you can also manage the password of the Directory Services Restore Mode (DSRM) account on Windows Server DCs. The DSRM account is used when a DC is started in Directory Services Restore Mode for Active Directory recovery and maintenance.

In order to enable DSRM password management, you need to config the Back up DSRM account password policy setting in the Windows LAPS GPO. You can find this setting by navigating to Computer Configuration > Policies > Administrative Templates > System > LAPS (here you need to enable Back up DSRM account password.

Windows LAPS automatically manages and backs up the DSRM password to Windows Server Active Directory. DSRM password backup requires password encryption to be enabled and is not supported for Microsoft Entra ID. The setting applies to Windows Server DCs.

How to Retrieve Windows LAPS passwords from Active Directory

Wait until the new GPO settings are applied to client workstations or update the settings manually using the command:

gpupdate /force

You can now verify and check for a new local administrator password for a computer in the object properties in AD (go to the LAPS tab).

How to View LAPS password using PowerShell

Use PowerShell to view the LAPS password for a domain computer:

Get-LapsADPassword -Identity "wks25h2"

You should add -AsPlainText only when you explicitly need the password in clear text.

All LAPS-related events can be tracked on clients in the Event Viewer (Applications and Services > Microsoft > Windows > LAPS).

Wrapping up

Windows LAPS mitigates the risks associated with using shared, static local administrator passwords across machines in a domain. It automates the generation of unique, complex passwords on each managed Windows device. Windows LAPS can back up local admin passwords to either Windows Server Active Directory or Microsoft Entra ID. In AD-joined environments you can manage Windows LAPS through Group Policy, while Microsoft Entra-joined devices can be managed through Microsoft Intune using the Windows LAPS CSP.