imPC@ndo IT

Guides / intune

Manage Windows LAPS from Microsoft Intune

Rotate the local administrator password automatically and store it in Entra ID. Why not to use the built-in Administrator account.

One of the most overlooked attack vectors in enterprise environments is the local administrator account. When every machine shares the same local admin password, a single compromised device can become a launchpad for lateral movement across your entire infrastructure. Windows LAPS solves this by automatically rotating and securely storing unique local admin passwords per device — managed entirely from Microsoft Intune.

What is Windows LAPS?

Windows LAPS is a built-in Windows feature that automatically manages and backs up the password of a local administrator account on Entra ID-joined or AD-joined devices. Instead of a static shared password, LAPS generates a unique complex password per device and rotates it on a defined schedule.

  • Prevents pass-the-hash and lateral movement attacks
  • Every device has a unique local admin password at all times
  • Recover devices that are unreachable over the network
  • Automatic password rotation with post-authentication cleanup

Prerequisites & Availability

  • Microsoft Intune Plan 1 license (minimum)
  • Microsoft Entra ID (free tier is sufficient)
  • Cloud Device Administrator to enable LAPS in Entra ID
  • Intune Administrator to create and assign the policy

Requires the April 11, 2023 cumulative update (or later) on:

Windows 11 22H2 / 21H2 — Pro, EDU, Enterprise Windows 10 — Pro, EDU, Enterprise Windows Server 2022 and Server Core 2022 Windows Server 2019

Enable LAPS in Microsoft Entra ID

This is a mandatory first step. The Intune policy will not back up passwords until LAPS is enabled at the Entra ID directory level.

  1. Sign in to entra.microsoft.com with at least the Cloud Device Administrator role.
  2. Navigate to Identity → Devices → All devices.
  3. Click Device settings in the top menu.
  4. Under Local administrator settings, toggle Enable Microsoft Entra Local Administrator Password Solution (LAPS) to Yes.
  5. Click Save.

Configure the LAPS Policy in Intune

Create the Policy

  1. Go to intune.microsoft.com → Endpoint Security → Account Protection.
  2. Click + Create Policy.
  3. Platform: Windows 10 and later — Profile: Local admin password solution (Windows LAPS).
  4. Click Create.

Basics

  1. Give the policy a clear Name (e.g. LAPS – All Windows Devices) and an optional description.
  2. Click Next.

Configuration Settings

Here is a breakdown of each setting with recommended values and the reasoning behind them:

Backup Directory Microsoft Entra ID only Stores the password in Entra ID so it can be retrieved from the portal without needing on-premises AD access. Password Age Days 30 days The password rotates automatically after this period. 30 days balances security with operational overhead. Administrator Account Name Leave blank (built-in) Targets the built-in local administrator account by well-known SID. Only specify a name if you use a custom account. Password Complexity Large + small + numbers + special chars Maximum complexity. No reason to lower this — make it as hard as possible for attackers. Password Length 14+ characters The default is 14. Consider raising to 20 for high-security environments — longer means exponentially harder to brute-force. Post Authentication Actions Reset password + Log off After the local admin account is used, force a password reset and log off — limits the window of exposure post-use. Post Auth Reset Delay 24 hours Grace period before the reset runs. Long enough to complete a legitimate maintenance task without cutting access mid-session.

Assignments & Review

  1. In Assignments, target All devices or a specific group for a staged rollout.
  2. In Review + create, verify all settings, then click Create.

You can also confirm locally in Registry Editor at: HKEY_LOCAL_MACHINESOFTWAREMicrosoftPoliciesLAPS

Look for BackupDirectory = 1 (Entra ID), PasswordAgeDays, PasswordComplexity, and PasswordLength.

Retrieve a Device’s Local Admin Password

Requires at least one of: Global Administrator, Cloud Device Administrator, or Intune Administrator.

From Microsoft Entra ID

  1. Go to entra.microsoft.com → Identity → Devices → All devices.
  2. Click the target device → select Local administrator password recovery.
  3. Click Show local administrator password → Show.

From Microsoft Intune

  1. Go to intune.microsoft.com → Devices → Windows.
  2. Click the target device → select Local admin password.
  3. Click Show local administrator password → Show.

Rotate the Password On Demand

Force an immediate password reset outside of the normal rotation cycle — useful after a security incident or a local admin session.

  1. Go to intune.microsoft.com → Devices → All devices.
  2. Click the target device → open the three-dot menu (···).
  3. Select Rotate local admin password.
  4. Confirm by clicking Yes.

Wrapping Up

Windows LAPS with Intune is a high-impact, low-effort security control. Once deployed, every managed Windows device has a unique rotating local admin password — significantly reducing your lateral movement attack surface.

  • Always enable LAPS in Entra ID first — Intune policy alone is not enough
  • Maximum complexity, 14+ chars, 30-day rotation or less
  • Enable Post Authentication Actions — reset and log off after every use
  • Audit every retrieval — Entra ID logs who accessed what and when

Original concept:cloudsecop.com — Original author: Aymen EL JAZIRI (Microsoft MVP)