Set Up Windows LAPS with Microsoft Intune for Enhanced Security

First, you need to enable LAPS at the tenant level in Microsoft Entra ID. This is a global setting that affects all devices in your organization.

Sign in to the Microsoft Entra admin center at https://portal.azure.com using an account with Cloud Device Administrator or Global Administrator permissions.

Navigate to Identity > Devices > Overview > Device settings.

Locate the setting Enable Local Administrator Password Solution (LAPS) and set it to Yes.

Click Save to apply the changes.

Windows LAPS requires the built-in administrator account to be enabled, which is often disabled by default on modern Windows installations. We'll create an Intune configuration profile to enable it.

Sign in to the Microsoft Intune admin center at https://intune.microsoft.com.

Navigate to Devices > Configuration profiles > Create profile.

Configure the profile settings:

• Platform: Windows 10 and later
• Profile type: Settings catalog

In the Basics tab, enter a name like "Enable Built-in Administrator for LAPS" and add a description.

In the Configuration settings tab, click Add settings and search for "Local Policies Security Options".

Select Accounts: Administrator account status and set it to Enabled.

In the Assignments tab, assign this profile to your target device groups. Start with a pilot group for testing.

Review your settings and click Create.

Now we'll create the main LAPS policy that defines password complexity, rotation schedule, and backup location.

In the Intune admin center, go to Endpoint security > Account protection > Create Policy.

Select the following options:

• Platform: Windows 10 and later
• Profile: Local admin password solution (Windows LAPS)

In the Basics tab, enter a name like "Windows LAPS Policy" and provide a clear description.

Configure the Configuration settings with these recommended values:

In the Assignments tab, add your target device groups. Start with your pilot group before expanding to production.

Review all settings and click Create.

After deploying the policies, you need to verify that LAPS is working correctly on your target devices.

On a target Windows device, open PowerShell as an administrator and run these verification commands:

# Check LAPS registry settings
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS"

# Verify LAPS service status
Get-Service -Name "LAPS" -ErrorAction SilentlyContinue

# Check LAPS event logs
Get-WinEvent -LogName "Application" | Where-Object {$_.ProviderName -eq "Microsoft-Windows-LAPS"} | Select-Object -First 10

# Force device sync with Intune
Get-ScheduledTask | Where-Object {$_.TaskName -eq "PushLaunch"} | Start-ScheduledTask

# Check device registration status
dsregcmd /status

You should see LAPS registry entries populated with your policy settings, and event logs should show LAPS activity.

To verify the administrator account is enabled:

net user administrator

The output should show "Account active: Yes".

Only authorized users should be able to retrieve LAPS passwords. Let's configure the appropriate permissions in Microsoft Entra ID.

In the Microsoft Entra admin center, navigate to Identity > Roles and administrators.

Search for and select the Cloud Device Administrator role, or create a custom role with specific LAPS permissions.

Click Add assignments and select the users or groups who should have access to retrieve LAPS passwords.

For more granular control, you can create a custom role with these specific permissions:

{
  "microsoft.directory/devices/localCredentials/read": true,
  "microsoft.directory/devices/read": true
}

To test password retrieval, authorized users can:

1. Go to the Microsoft Entra admin center
2. Navigate to Identity > Devices > All devices
3. Select a device with LAPS enabled
4. Click Local Administrator Password to view the current password

Proper monitoring ensures your LAPS deployment is working correctly and helps identify issues quickly.

In the Intune admin center, monitor policy deployment status:

1. Go to Endpoint security > Account protection
2. Select your LAPS policy
3. Click Device status to see deployment results

Common issues and their solutions:

Use these PowerShell commands for advanced troubleshooting:

# Check detailed device registration
dsregcmd /status | Select-String -Pattern "AzureAdJoined|DomainJoined|WorkplaceJoined"

# Verify Intune management extension
Get-Process -Name "Microsoft.Management.Services.IntuneWindowsAgent" -ErrorAction SilentlyContinue

# Check LAPS configuration in registry
Get-ChildItem -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS" -Recurse

# Force immediate password rotation (for testing)
Invoke-Command -ScriptBlock {Reset-ComputerMachinePassword}