Deploy Windows LAPS in a hybrid Active Directory and Microsoft Entra ID environment

The problem Windows LAPS removes

Reusing one local administrator password across endpoints turns a single compromise into a lateral movement path. Windows LAPS generates a unique password per device, rotates it and backs it up to Active Directory or Microsoft Entra ID for authorized staff.

Windows LAPS is built into supported Windows releases after the April 2023 updates. It progressively replaces the legacy Microsoft LAPS MSI and adds Entra storage, AD encryption, password history and post-authentication actions.

• Microsoft — Windows LAPS overview ↗
• Related guide — Active Directory security assessment →

Hybrid does not mean backing up to two places

Device join state determines the possible destination. An Entra-only device backs up to Entra; a domain-only device backs up to AD. A hybrid device can use either destination, but never both at once.

Choose according to the operating model. AD suits servers, domain-dependent endpoints, offline administration and OU delegation. Entra suits modern Intune-managed endpoints and portal or Graph retrieval. Passwords sent directly to Entra do not transit through Entra Connect.

• Microsoft — Windows LAPS join-state restrictions ↗

Prepare Active Directory without broadening access

For AD backup, extend the schema once per forest, then let computer objects write their own LAPS attributes in the targeted OUs. Delegate read and expiration separately. Search for extended-right holders before rollout: an old group with All Extended Rights can read confidential attributes.

AD password encryption requires a Windows Server 2016 or later domain functional level. Windows Server 2016 domain controllers cannot manage their DSRM password with Windows LAPS, even when domain clients use encrypted storage.

Import-Module LAPS
Update-LapsADSchema -Verbose
$ou = 'OU=Workstations,DC=contoso,DC=local'
Set-LapsADComputerSelfPermission -Identity $ou
Set-LapsADReadPasswordPermission -Identity $ou `
  -AllowedPrincipals 'CONTOSO\LAPS-Password-Readers'
Set-LapsADResetPasswordPermission -Identity $ou `
  -AllowedPrincipals 'CONTOSO\LAPS-Password-Resetters'
Find-LapsADExtendedRights -Identity $ou

• Microsoft — Deploy Windows LAPS with Active Directory ↗

Configure an AD GPO with explicit choices

Settings are under Computer Configuration > Administrative Templates > System > LAPS. At minimum, configure the backup directory. Do not set AdministratorAccountName when managing the built-in Administrator account: Windows identifies it by RID regardless of its localized name.

If you target a custom account, create it and manage its Administrators membership separately. Windows LAPS does not create it on releases before automatic account management in Windows 11 24H2 and Windows Server 2025.

• Microsoft — Windows LAPS policy settings ↗

Deploy with Intune and back up to Entra

First enable Windows LAPS in Entra device settings. In Intune, create an Endpoint security > Account protection policy and target a small pilot. Set BackupDirectory to Microsoft Entra ID, then define length, age and post-authentication actions.

Password retrieval should be exceptional. Use appropriate Entra roles, PIM where available and audit logs. DeviceLocalCredential.ReadBasic.All exposes metadata only; DeviceLocalCredential.Read.All can read the clear-text secret and should be treated as sensitive privilege.

• Microsoft — Deploy Windows LAPS with Microsoft Entra ID ↗
• Related guide — Passkeys with Microsoft Entra ID →

Validate processing and retrieve a password

Windows LAPS processes policy periodically and responds to policy changes. Run Invoke-LapsPolicyProcessing on a pilot to avoid waiting. Successful AD backup produces event 10018; successful Entra backup produces event 10029 in Microsoft-Windows-LAPS/Operational.

Do not expose a clear-text password in a ticket, PowerShell transcript or CSV. Retrieve it only for the intervention, tie the access to an approved request and force rotation afterward if policy does not do so automatically.

Invoke-LapsPolicyProcessing
Get-WinEvent -LogName 'Microsoft-Windows-LAPS/Operational' -MaxEvents 20
Get-LapsADPassword -Identity PC-042
Get-LapsADPassword -Identity PC-042 -AsPlainText
Get-LapsAADPassword -DeviceIds PC-042
Get-LapsAADPassword -DeviceIds PC-042 -IncludePasswords

Rotate after use

Post-authentication actions limit how long a retrieved password remains useful. Value 3 rotates it, signs out interactive sessions using the account and removes SMB sessions after the delay. Value 5 also restarts the device and is more disruptive. Test on admin workstations, kiosks and servers before broad enforcement.

After an incident, Reset-LapsPassword forces immediate local rotation. For AD-backed secrets, Set-LapsADPasswordExpirationTime can expire the password so the endpoint replaces it at the next cycle.

Reset-LapsPassword
Set-LapsADPasswordExpirationTime -Identity PC-042
Invoke-LapsPolicyProcessing

Migrate from legacy Microsoft LAPS

Inventory GPOs, the MSI, ms-Mcs-AdmPwd attributes, reader groups and current support tools. Windows LAPS can emulate the legacy behavior during transition, but do not leave two competing policies managing the same account.

Use a pilot OU, confirm the new event channel and attributes, update service-desk procedures, then gradually remove the client-side extension and legacy MSI. Keep recovery capability until every endpoint has processed the new policy.

• Microsoft — Legacy LAPS emulation and interoperability ↗

A four-wave rollout

Measure devices with a current password, LAPS log errors, secret retrievals and exceptions. Rollout is complete only when recovery works during a network outage or off-domain intervention.

Security checklist

Windows LAPS is easy to enable, but its security value depends on delegation, recovery and monitoring choices. In a hybrid environment, the first decision is not GPO versus Intune; it is where the secret should live and who can truly retrieve it.

• Choose one backup destination per hybrid device.
• Encrypt AD-stored passwords when the functional level supports it.
• Separate password read, expiration and policy administration.
• Audit All Extended Rights on each targeted OU.
• Explicitly create and maintain any custom administrator account.
• Protect Entra roles and Graph permissions that can reveal the secret.
• Enable and test post-authentication actions.
• Monitor events 10018, 10029 and LAPS channel errors.
• Test AD, Entra and DSRM recovery before an incident.

• Service — Active Directory security assessment →
• Related guide — SMB hardening →