Windows LAPS Intune Setup: One Rotating Admin Password Per PC

Someone imaged the office PCs years ago, set one local administrator password on all of them, and that password now lives on a sticky note, in a former technician's head, and in a spreadsheet nobody can find. Setting up Windows LAPS with Intune and Microsoft Entra ID replaces that one shared secret with a different, rotating password on every machine, retrievable by the people you choose and logged every time someone looks.

Microsoft describes the problem plainly: local administrator accounts often share the same password across many devices, which attackers can exploit to move laterally. The fix is built into Windows. The work is turning it on in the right order and choosing settings that do not surprise whoever uses the password at two in the morning.

Windows LAPS or legacy Microsoft LAPS?

The legacy Microsoft LAPS product, released in 2016 as a separate download, is deprecated as of Windows 11 23H2, and newer versions of Windows block installation of its installer package. Windows LAPS shipped as part of the Windows updates released on April 11, 2023, and requires no separate download or installation.

The decisive difference for a cloud-managed office is where the password can live. Legacy LAPS, and the emulation mode that lets Windows LAPS honor old legacy policies, stores passwords in Windows Server Active Directory only, in clear text. Microsoft states that in emulation mode you cannot configure Windows LAPS to save passwords to Microsoft Entra ID. If your PCs are Entra joined and managed by Intune, legacy LAPS is not an option at all. On domain-joined machines still running it, treat emulation as a temporary bridge.

During a migration, settings delivered through the Intune configuration service provider take precedence over, and overwrite, Group Policy or legacy tool settings. Windows LAPS manages a single local administrator account per device, and two tools managing one account is not supported.

What has to be true before you start

Check three things before touching a policy.

• Join type. LAPS with Entra ID is supported on Microsoft Entra joined or hybrid joined devices only. Entra registered devices are not supported.
• Windows version. Windows 11 23H2 and later include it, and older Windows 11 builds need the April 11, 2023 update or later. Windows 10 reached end of support on October 14, 2025, and Windows LAPS remains available there only on devices still receiving updates, such as through Extended Security Updates.
• Licensing. Backing passwords up to Entra ID works with Microsoft Entra ID Free or higher. Intune, custom roles and Conditional Access carry their own licensing.

A hybrid joined machine can back up to either Entra ID or on-premises Active Directory, but never both at once. Decide which one before writing policy, because that choice drives everything else.

Step one: allow devices to post passwords to Entra ID

By default, Microsoft Entra ID does not allow managed devices to post new Windows LAPS passwords. Sign in to the Microsoft Entra admin center as at least a Cloud Device Administrator, browse to Entra ID > Devices > Overview > Device settings, select Yes for Enable Local Administrator Password Solution (LAPS), and save. Until that switch is on, a perfectly configured Intune policy has nowhere to send its passwords.

Step two: build the Intune account protection policy

Creating the policy needs rights from the Security baseline category, which the built-in Endpoint Security Manager role includes. In the Intune admin center, go to Endpoint security > Account protection, select Create Policy, set the platform to Windows and the profile to Local admin password solution (Windows LAPS). The settings that matter, with the limits Microsoft documents:

• Backup Directory. Disabled, Microsoft Entra only, or Active Directory only. If not set it defaults to Disabled, and when it is Disabled every other setting is ignored. For an Entra joined fleet, choose Entra.
• Password Age Days. Maximum 365 days, default 30. When the backup directory is Entra ID the minimum is seven days. Changing this value does not change the expiration of the current password and does not trigger a rotation.
• Password Complexity. Defaults to 4, large and small letters plus numbers and special characters. Microsoft recommends always using 4 or higher. Values 5 through 8, including the passphrase options, need Windows 11 24H2 or later.
• Password Length. 8 to 64 characters, default 14.
• Administrator Account Name. Leave it blank to manage the built-in administrator, which LAPS finds by its well-known RID rather than its name. If you name a custom account, LAPS does not create it; if the named account is not on the device, no account is managed.
• Post Authentication Reset Delay. Hours to wait after the managed account is used before acting, from 0 to 24, default 24. Zero disables all post-authentication actions.
• Post Authentication Actions. What happens when that delay runs out: reset password (1), reset password and sign out (3, the default), reset password and reboot (5), or a stricter sign-out that also ends remaining processes (11, Windows 11 24H2 and later).

On Windows 11 24H2 and later there is also Automatic Account Management, off by default. When enabled it can manage the built-in account or a new custom account, named WLapsAdmin by default, optionally with a random six-digit suffix added at every rotation. When it is on, the Administrator Account Name setting is ignored.

Assign the policy to device groups, not user groups. Microsoft supports user group assignment but warns it can cause the configuration to change each time a different user signs in. One policy per device is the safe pattern.

Getting a password out

In the Intune admin center, go to Devices > All devices, open the PC, and under Monitor select Local admin password. The pane shows the account name, its security ID, the password (hidden until you select Show), and the last and next rotation times in UTC. Every retrieval triggers an audit event. In the Entra admin center, Audit logs can be filtered for the activity Recover device local administrator password.

Who can see what is set by Entra roles. Cloud Device Administrator and Intune Service Administrator can read the password and its metadata. Helpdesk Administrator, Security Administrator and Security Reader can read the metadata only. For finer control, a custom role needs microsoft.directory/deviceLocalCredentials/password/read, and custom roles require Entra ID P1 or P2. Conditional Access can be scoped to the built-in roles, but not to custom or administrative-unit-scoped roles.

From PowerShell, Get-LapsAADPassword with -DeviceIds and -IncludePasswords returns the password as a SecureString, and -AsPlainText shows it in clear text. It is a wrapper around the Microsoft Graph PowerShell library, which you install first, and it needs a registered Entra app with Device.Read.All plus DeviceLocalCredential.Read.All. If two devices share a name the cmdlet fails, so pass the device ID.

Rotating a password by hand

After anyone uses the password, rotate it. In Intune, open the device, expand the ellipsis on the menu bar and choose Rotate local admin password. The admin needs three Intune permissions: Managed devices: Read, Organization: Read, and Remote tasks: Rotate Local Admin Password. For Entra joined devices the PC must be online when you ask, or the request fails. There is no bulk rotation, only one device at a time. A manual rotation also resets the clock for the next scheduled one.

On the device itself, Reset-LapsPassword forces an early rotation. Microsoft warns that excessively frequent use can be throttled.

Where this goes wrong

The password works, then the session vanishes. With the default action 3, the password is reset and interactive sessions using the account are terminated after a nonconfigurable two-minute warning. Action 5 restarts the PC after a one-minute delay. Microsoft warns this can cause data loss. A technician who signs in with the LAPS account, starts a long repair, and leaves it for a day will lose the session when the grace period expires. The device logs event 10041 when it detects the sign-in and 10042 when the grace period runs out, so the log tells you exactly what happened.

The policy never applies. Conflicting LAPS policies on one device can stop processing entirely. If a device with no LAPS policy receives two conflicting ones at once, settings are not sent at all and both report a conflict. Until a device checks in and processes its policy, Intune has no account data to show.

The backup directory does not match the join type. Set the directory to Active Directory on an Entra-only PC and the device applies the policy without error, yet cannot back up the account.

The device cannot reach Entra. Windows LAPS processes policy every hour, and backs up to Entra directly over https with no dependence on Entra Connect sync. An Entra joined PC that is offline when a manual rotation is requested fails it, and so does any device that never backed up its password. On the PC, open Applications and Services > Logs > Microsoft > Windows > LAPS > Operational and look for 10029, which confirms the update to Entra. A 10005 means the cycle failed, and a 10027 points to a length or complexity value the local password policy rejects.

The device record gets deleted. When a device is deleted in Entra ID, the stored LAPS password goes with it, and there is no method in Entra ID to recover it.

Worked example: a break-glass drill in a 25-PC office

A 25-PC office runs Entra joined Windows 11 machines enrolled in Intune, all sharing one old local admin password. The IT lead turns on the Entra device setting, then creates one LAPS policy: backup to Entra, password age 30 days, complexity 4, length 20, administrator account name blank, reset delay 8 hours, post-authentication action 1. He chooses reset-only because whoever uses the password will likely be mid-repair, and a forced sign-out would cost them work. He assigns it to a device group containing all 25 PCs.

Next morning he picks one PC, runs Invoke-LapsPolicyProcessing to skip the hourly wait, and confirms 10029 in the LAPS Operational log. In Intune, the Local admin password pane now shows the account and a next rotation date. He spot-checks five more before trusting the rest.

Then the drill. A second admin, holding Cloud Device Administrator and signing in with multifactor authentication, plays the night-time responder. She retrieves the password for a test PC from Intune, signs in locally with it, and confirms it works. The IT lead confirms the Recover device local administrator password entry in the Entra audit log. Eight hours later the PC logs 10042 and the password changes on its own. He also rotates a second PC by hand from Intune and watches the action go from Pending to Complete. The drill proves the password is stored, the right person can get it, the access is recorded, and the credential does not outlive its use. He repeats it quarterly, because a recovery path nobody has walked is a guess.

The decision rule

If your PCs are Entra joined, use Windows LAPS through Intune and never install legacy LAPS. Turn on the Entra device setting first, assign exactly one policy per device through a device group, and match the backup directory to the join type. Choose the post-authentication action by who will use the password: reset-only when the user is a technician doing long work, sign-out or reboot when the risk is the password lingering. Do not call it done until one person has retrieved a password, used it, and watched it rotate.