Windows LAPS Deployment Guide: How to Eliminate Shared Local Admin Passwords and Stop Lateral Movement

Legacy Microsoft LAPS (download from Microsoft, deployed as an MSI + ADMX templates + AD schema extension) stores passwords in cleartext in the AD attribute ms-Mcs-AdmPwd. Any user with read permission on the computer object can retrieve the password. It works on Windows Server 2003+ and is well understood, but the cleartext storage is a significant weakness.

Windows LAPS (built into Windows since April 2023 cumulative update) stores passwords encrypted in AD using DPAPI-NG, supports Azure AD-joined devices, supports backup to both AD and Azure AD simultaneously, and includes post-authentication actions (auto-rotate after use). It requires:

• Windows 10 22H2 / Windows 11 22H2 / Server 2019 or later (with April 2023 CU or later)
• Domain functional level Windows Server 2016 or later for the encrypted storage feature

If you are on legacy LAPS today: migrate to Windows LAPS. The migration path supports running both in parallel during transition. Legacy LAPS will not receive new feature development.

Check which version is active on an endpoint:

Get-LapsAADPassword -DeviceId (Get-AzureADDevice -SearchString $env:COMPUTERNAME).ObjectId
# If this fails, check if Windows LAPS is configured:
Get-LapsAADPasswordPolicy
# Or for AD-backed LAPS:
Get-LapsDiagnostics

Windows LAPS requires a one-time AD schema extension before the first policy can be applied.

Step 1: Update the AD schema (run on a DC or from a machine with AD Schema snap-in)

Update-LapsADSchema
# Creates the new LAPS attributes:
# msLAPS-Password (encrypted), msLAPS-PasswordExpirationTime, msLAPS-EncryptedPassword

Step 2: Grant computers permission to write their own LAPS attribute

# Grant the OU containing your workstations
Set-LapsADComputerSelfPermission -Identity 'OU=Workstations,DC=domain,DC=com'
# Repeat for each OU containing managed computers

Step 3: Grant help desk or admins read permission

# Grant a specific AD group permission to read LAPS passwords
Set-LapsADReadPasswordPermission `
    -Identity 'OU=Workstations,DC=domain,DC=com' `
    -AllowedPrincipals 'DOMAIN\HelpDesk-LAPS-Readers'

Step 4: Configure via Group Policy

Path: Computer Configuration > Administrative Templates > System > LAPS

Key settings:

• Configure password backup directory: Active Directory (or Azure AD, or both)
• Password Settings: Enable -- set complexity, length (minimum 14), age (30 days)
• Do not allow password expiration time longer than required by policy: Enabled
• Enable password encryption: Enabled (requires domain functional level 2016+)
• Post-authentication actions: Reset the password and logoff the managed account (prevents reuse after retrieval)

For cloud-only or hybrid Azure AD-joined devices managed via Intune:

Intune path: Endpoint Security > Account Protection > Create Policy > Windows 10 and later > Local admin password solution (Windows LAPS)

Key settings:

• Backup directory: Azure Active Directory
• Password age days: 30
• Administrator account name: (leave blank to manage the built-in Administrator, or specify a custom account name)
• Password complexity: Large letters + small letters + numbers + special characters
• Password length: 14 minimum
• Post authentication actions: Reset password and logoff
• Post authentication reset delay: 24 hours

Retrieve a password from Azure AD (authorized users only):

# Install Microsoft Graph module if needed
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes 'DeviceLocalCredential.Read.All'
# Get password for a specific device
Get-LapsAADPassword -DeviceIds 'device-object-id' -IncludePasswords

Or via the Azure portal: Azure Active Directory > Devices > select device > Local administrator password.

Retrieve from Active Directory:

# Retrieve the current LAPS password for a computer
Get-LapsADPassword -Identity 'WORKSTATION01' -AsPlainText
# Returns: ComputerName, DistinguishedName, Account, Password, PasswordUpdateTime, ExpirationTimestamp

Or use the LAPS UI tool (Windows LAPS includes a GUI accessible from: Start > Windows LAPS > LAPS UI).

Audit LAPS password retrievals:

Every retrieval of a LAPS password generates an event on the domain controller:

• Event ID 4662 in the Security log with Object Type = msLAPS-Password or msLAPS-EncryptedPassword

Alert on these events and correlate: who retrieved the password, for which machine, and at what time. A help desk engineer retrieving a LAPS password for a machine they have a ticket for is expected. A service account or automated process reading LAPS passwords for 50 machines in five minutes is a red flag.

# Query for LAPS read events on DCs
Get-WinEvent -ComputerName dc01 -FilterHashtable @{
    LogName = 'Security'
    Id = 4662
} | Where-Object { $_.Message -match 'msLAPS' } |
    Select-Object TimeCreated, @{N='User';E={$_.Properties[1].Value}}, @{N='Object';E={$_.Properties[4].Value}}