The classic small-business setup: every laptop was imaged with the same local administrator account and the same password, written on a sticky note three IT people ago. One compromised machine and that credential works everywhere. Windows LAPS (Local Administrator Password Solution) fixes it by setting a unique, random password on each device and backing it up to Entra ID, where you can retrieve it on demand and rotate it automatically.
What you need
- Windows 10/11 with a current cumulative update. LAPS is built into Windows now; the old standalone MSI is legacy.
- Entra-joined or Entra hybrid-joined devices enrolled in Intune.
- A role that can read passwords: Cloud Device Administrator, Intune Administrator, or a custom role with the LAPS read permission.
Step 1: Turn on LAPS in Entra ID
Before any policy will store a password, enable the directory setting: Entra admin center → Devices → Device settings → Enable Local Administrator Password Solution (LAPS) = Yes. Miss this and devices report success locally but nothing ever lands in the directory.
Step 2: Decide which account LAPS manages
LAPS manages one local account. Two sane options:
| Manage the built-in Administrator | Manage a new named account | |
|---|---|---|
| Setup | Nothing to create; it already exists (but is disabled by default) | LAPS can create and manage it for you |
| Pro | Simple, well-known SID | Keeps the built-in admin disabled; clearer audit trail |
| Watch out | You must enable it, and attackers know the name | Set the account name consistently across the policy |
I target a dedicated managed account in most tenants and leave the built-in Administrator disabled.
Step 3: Build the Intune policy
In Intune: Endpoint security → Account protection → Create Policy → Windows → Local admin password solution (Windows LAPS). The settings that matter:
- Backup Directory: Backup the password to Azure AD only.
- Password Age Days: 30 is a reasonable default.
- Administrator Account Name: your named account (leave blank to manage the built-in Administrator).
- Password Complexity: large letters + small letters + numbers + specials.
- Post Authentication Actions: reset the password and log off, or reset and reboot, a set time after the admin account is used. This is what makes a retrieved password single-use in practice.
Assign the policy to a device group, not a user group. LAPS is a device setting.
Step 4: Retrieve a password when you need it
From the device record in Intune or Entra, open Local admin password and show the current value. Every retrieval is logged. You can also pull it with Graph PowerShell:
Connect-MgGraph -Scopes "DeviceLocalCredential.Read.All","Device.Read.All"
$deviceName = "LAPTOP-07"
$id = (Get-MgDevice -Filter "displayName eq '$deviceName'").DeviceId
Get-MgDeviceLocalCredential -DeviceLocalCredentialInfoId $id |
Select-Object -ExpandProperty CredentialsAfter you use it, trigger a rotation from the same pane so the shown password stops working.
Why a device won't back up
- Directory setting off. Step 1. The most common cause by far.
- Policy assigned to users, not devices. Reassign to a device group.
- Device not actually Entra-joined (it's Entra-registered, or workgroup). Check
dsregcmd /status. - Not synced yet. LAPS honours its own schedule; force a check-in or wait a cycle.
- Check the client:
Get-LapsADPasswordis for AD; for Entra, review Event Viewer under Applications and Services Logs → Microsoft → Windows → LAPS → Operational. The events tell you exactly why.
Frequently asked questions
Does Windows LAPS back up to Entra ID or Active Directory?
Both are supported. For cloud and hybrid small businesses, back the password up to Entra ID; on-prem-first environments can target Active Directory. They're different directory targets with different retrieval paths.
Why isn't my device backing up its LAPS password?
The most common cause is the directory setting not being enabled in Entra, followed by the policy being assigned to users instead of devices, or the device not actually being Entra-joined. Check the LAPS Operational event log for the exact reason.
Who can read the LAPS password in Intune?
Global Administrator, Intune Administrator, Cloud Device Administrator, or a custom role with the device local credential read permission. Every retrieval is logged, and you can scope a help-desk role to read-only.