🧱🪟💻ES - Windows LAPS
One shared local-admin password across the fleet is a skeleton key. LAPS gives every machine its own, rotates it automatically, and stores it in Entra.
What this policy is about 🧱
Nearly every managed device has a local administrator account, and far too often it is the same password on all of them, set once during imaging and never touched again. That single shared secret is the classic lateral-movement highway: compromise one machine, grab the local-admin hash, and reuse it on every other device that shares it.
Windows LAPS closes that off. It sets a unique, random password on each device's local admin account, rotates it on a schedule, and backs it up to Entra ID where only authorised admins can retrieve it. Steal one and you have opened exactly one machine.
The fix is not a stronger shared password; it is no shared password at all. LAPS makes the local-admin credential per-device and short-lived, so a stolen one is worth one door and expires anyway.
Why this matters 🕵️
Pass-the-hash across a reused local admin is one of the most reliable moves an attacker has, precisely because the shared password is invisible in day-to-day operations, it just sits there working. LAPS turns that highway into a set of dead ends: each credential is unique, rotates automatically, and every retrieval from Entra is logged, so break-glass local access stays possible but auditable.
🛠️ Configuration
Where: Intune admin center → Endpoint security → Account protection → Create policy → Windows → Local admin password solution (Windows LAPS).
The same settings are reachable through Devices → Configuration → Settings catalog → LAPS, because both write to the LAPS CSP. Pick one and stay there: the same setting configured from two profiles lands the device in a conflict state where neither value reliably applies.
| Setting | Value |
|---|---|
| Backup Directory | Backup the password to Microsoft Entra ID only |
| Password Age Days | 30 |
| Password Length | 20 |
| Password Complexity | Large letters, small letters, numbers, and special characters |
| Post Authentication Actions | Reset the password and logoff the managed account |
| Post Authentication Reset Delay (hours) | 24 |
| Assignment, include | All devices |
| Assignment, exclude | None (standard exclusions only) |
The post-authentication reset is the quiet hero: after the password is used, it rotates automatically within the delay window, so a retrieved credential is good for a job, not forever.
Caveats ⚠️
LAPS needs an account to manage. By default it targets the built-in Administrator. If that account is disabled or renamed on your image, set the Administrator Account Name so LAPS manages the right one. No managed account, nothing to rotate.
Entra backup means Entra-joined. Backing up to Entra ID requires the device to be Entra joined. Hybrid or on-prem AD-joined devices back up to Active Directory instead, which is a different Backup Directory value.
Retrieval is a privilege, so treat it like one. Reading a device's LAPS password from Entra needs the right role. Scope who can do it, and review the retrieval logs; the audit trail is only useful if someone looks at it.
License and reversibility. Entra ID LAPS is included in Business Premium. Clean-revert: unassign and Windows stops rotating the account, though the last-set password remains until changed.
🔗 Related
- 🧱🪟💻ES - LSA Protection: stops the credential theft that makes a reused local-admin password so dangerous in the first place.
This password will self-destruct in 24 hours. One key per lock, and none of them shared. 🧱