This article explains how to enable and configure LAPS for Windows 11 client workstations in an Active Directory environment.
Windows LAPS Overview
The Local Administrator Password Solution (LAPS) feature in Microsoft networks is used to automatically manage and securely store (backup) passwords for local administrator accounts on computers joined to on-premises Active Directory domains or Microsoft Entra ID (formerly Azure AD).
After configuring the LAPS component on each workstation, it will generate a unique, random password for the built-in local administrator account on each domain-joined machine. This password can then be stored in AD or Entra ID and updated regularly. This ensures that local administrator passwords on domain-joined machines remain unique, which mitigates the risk of lateral movement if a password or its hash is compromised on a single system.
Prior to the introduction of Windows LAPS in the April 2023 security updates, administrators had to deploy the Legacy Microsoft LAPS MSI package, known as Legacy LAPS. The modern Windows LAPS component is integrated into newer Windows 11 releases and does not require manual installation.
Setup Prerequisites for Windows LAPS in AD
- Minimum Active Directory Domain Functional Level โ Windows Server 2016
- Supported operating systems: Windows 11 and 10; Windows 2025, 2022, 2019 with the April 11 2023 update, 2016 (with updates) or later installed.
How to Enable Windows LAPS in Active Directory
To enable Windows LAPS support in Active Directory, the AD schema must be extended by adding LAPS attributes. To do this, sign in to the AD domain controller with an account that is a member of the Schema Admins and Enterprise Admins group. Open an elevated PowerShell prompt and run the command:
Update-LapsADSchema -Verbose
Now check if the msLAPS-Password schema attribute exists before continuing:
Get-ADObject `
-SearchBase (Get-ADRootDSE).SchemaNamingContext `
-LDAPFilter "(lDAPDisplayName=msLAPS-Password)"
After updating the schema, run the ADUC console (dsa.msc) and open the properties of any computer object. Verify that a new LAPS tab has appeared and that new attributes beginning with msLAPS-* have been added to the Attributes Editor of a computer object.
Update LAPS attributes
Computer accounts require delegated permissions on their LAPS attributes in Active Directory to write and update their LAPS-managed password attributes. Specify the distinguishedName of the Organizational Unit (OU) containing the computer accounts authorized to update their LAPS attributes:
Set-LapsADComputerSelfPermission -Identity "OU=Workstations,OU=HQ,DC=theitbros,DC=com"
Granting read and reset permissions for LAPS passwords
Run the following command to grant read and reset permissions to members of the HQ_HelpDesk security group for LAPS passwords on computers in the specified OU:
Set-LapsADReadPasswordPermission -Identity "OU=Workstations,OU=HQ,DC=theitbros,DC=com" -AllowedPrincipal "THEITBROS\HQ_HelpDesk"
In order to allow Help Desk operators to force a password rotation for managed local admin accounts, you should delegate the LAPS password reset permission:
Set-LapsADResetPasswordPermission `
-Identity "OU=Workstations,OU=HQ,DC=theitbros,DC=com" `
-AllowedPrincipal "THEITBROS\HQ_HelpDesk"
In order to check which users and groups have delegated Windows LAPS permissions on the OU, run the command:
Find-LapsADExtendedRights `
-Identity "OU=Workstations,OU=HQ,DC=theitbros,DC=com"
Configuring Windows LAPS Group Policy Settings
To enable LAPS for domain workstations, configure a GPO with LAPS settings and link it to the OU containing the target computer accounts:
- Open the Group Policy Management console (gpmc.msc) and create a new GPO.
- Switch to policy editing mode.
- Navigate to Computer Configuration > Policies > Administrative Templates > System > LAPS. This GPO section contains LAPS settings that can be configured.
Hint. If this GPO section is missing, you can copy the LAPS administrative template file from a Windows 11 client computer. Copy the C:\Windows\PolicyDefinitions\LAPS.admx file from a client device to the central store GPO on the domain controller \\theitbros.com \SYSVOL \theitbros.com \Policies \PolicyDefinitions.
Enable and configure the following GPO options:
- Configure password backup directory: Active Directory
- Password Settings: Set the desired password complexity, length, and change frequency.
- Enable Password Encryption (optional)ย โ Should the password be stored encrypted in AD? Note that in case password encryption is enabled, authorized principals must be configured in order to decrypt LAPS passwords.
- Name of administrator account to manage (optional) โ Use this if you want to manage the password for an account other than the built-in Administrator account.
- Post-Authentication actions (optional): Allows you to set an action that is triggered when someone uses the LAPS password. For example, setting 8 hours here will enable automatic password reset, and optionally enforce logoff of the LAPS-managed account after a configurable grace period.
All that remains is to link the GPO to the appropriate OU with Windows 11 workstations to enable LAPS password management for them.
How to Retrieve Windows LAPS passwords from Active Directory
Wait until the new GPO settings are applied to client workstations or update the settings manually using the command:
gpupdate /force
You can now verify and check for a new local administrator password for a computer in the object properties in AD (go to the LAPS tab).
How to View LAPS password using PowerShell
Use PowerShell to view the LAPS password for a domain computer:
Get-LapsADPassword -Identity "wks25h2" -AsPlainText
All LAPS-related events can be tracked on clients in the Event Viewer (Applications and Services > Microsoft > Windows > LAPS).
Wrapping up
Windows LAPS mitigates the risks associated with using shared, static local administrator passwords across machines in a domain. It automates the generation of unique, complex passwords on each managed Windows device. Then, local admin passwords are securely stored in either Active Directory or Entra ID.
Why should I use Windows LAPS?
Windows LAPS reduces the risk of lateral movement by ensuring each computer has a unique local administrator password. If one machine is compromised, attackers cannot reuse the same password on other systems.
What are the prerequisites to enable Windows LAPS in Active Directory?
Your Active Directory domain functional level must be at least Windows Server 2016, and the environment must run supported Windows versions with the required updates installed.
How do I enable Windows LAPS in Active Directory?
You must extend the Active Directory schema by running the Update-LapsADSchema PowerShell command using an account that is a member of the Schema Admins and Enterprise Admins groups.
What LAPS settings can be configured in Group Policy?
You can configure the password backup location, password complexity and rotation interval, optional encryption of passwords in AD, the administrator account to manage, and post-authentication actions such as automatic password reset.
How can I view a LAPS password using PowerShell?
You can use the Get-LapsADPassword cmdlet to retrieve the local administrator password for a specific computer.
Where can I monitor LAPS-related events?
All LAPS-related activity is logged in the Event Viewer under Applications and Services > Microsoft > Windows > LAPS.
