How to Configure Windows LAPS in Microsoft Intune: Complete Step-by-Step Guide

Why Modern Windows LAPS Replaced Legacy LAPS

For more than a decade, systems engineers managed endpoint administrator credentials using legacy Microsoft LAPS. That older tool required deploying an external MSI package (AdmPwd.dll), extending the Active Directory schema, and maintaining Group Policy Objects. It did not support cloud-only Microsoft Entra ID joined endpoints without custom scripts, third-party agents, or hybrid domain workarounds.

Modern Windows LAPS is natively integrated into the Windows operating system starting with Windows 10 (20H2, 21H2, 22H2 with the April 2023 cumulative update or later) and Windows 11. It operates through the native OS kernel, requires no MSI installation, and writes encrypted passwords directly to Microsoft Entra ID or on-premises Active Directory.

Prerequisites for Windows LAPS in Microsoft Intune

Before creating your deployment policy in Intune, verify these core prerequisites across your tenant and client estate:

• Supported OS Editions: Windows 11 (Pro, Enterprise, Education) or Windows 10 (versions 20H2, 21H2, 22H2 with April 11, 2023 cumulative update KB5025221 or later). Windows Home editions are not supported.
• Device Join State: Devices must be Microsoft Entra joined or Microsoft Entra hybrid joined. Microsoft Entra registered (BYOD or Workplace Joined) devices are not supported.
• Tenant Licensing: Microsoft Intune Plan 1 license (included in Microsoft 365 Business Premium, E3, E5, and EMS E3/E5). Microsoft Entra ID Free or P1/P2.
• Administrative Roles: Intune Administrator or Endpoint Security Manager to create and assign policies. Cloud Device Administrator or Helpdesk Administrator in Entra ID to retrieve passwords.

Step 1: Enable Windows LAPS in Microsoft Entra ID

Microsoft Entra ID requires an administrative opt-in to accept and store LAPS passwords from managed endpoints. Turning on this tenant setting is the first required step.

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com).
2. In the left navigation menu, expand Devices and select All devices.
3. Under the Manage section, click Device settings.
4. Locate the setting labeled Enable Microsoft Entra Local Administrator Password Solution (LAPS).
5. Toggle the switch to Yes.
6. Click Save at the top of the page.

Step 2: Create the Windows LAPS Policy in Microsoft Intune

Intune manages Windows LAPS through the Endpoint Security Account Protection configuration service provider (CSP).

1. Sign in to the Microsoft Intune admin center (intune.microsoft.com).
2. Go to Endpoint security > Account protection.
3. Click Create Policy at the top of the table.
4. Set Platform to Windows (or Windows 10 and later).
5. Set Profile to Local admin password solution (Windows LAPS).
6. Click Create.

In the Basics tab, provide a descriptive name and enterprise description:

• Name: TechEUC - Microsoft Windows LAPS
• Description: Windows LAPS Configuration policy in Microsoft Intune for TechEUC devices.

Click Next to proceed to Configuration settings.

Step 3: Configure LAPS Policy Settings and Automatic Account Management

The configuration settings tab defines how passwords are generated, rotated, and backed up. Windows LAPS includes native Automatic Account Management, which can provision a new custom local administrator account automatically on target workstations.

In our lab environment, we configure the policy to manage a custom account named ITAdmin:

Review the purpose of each setting configured in this profile:

Click Next. On the Scope tags tab, select your required scope tag (or keep Default) and click Next:

On the Assignments tab, assign the policy to your targeted Windows device group (e.g. All Windows Devices or a pilot group). Complete the wizard on the Review + create tab and click Save.

Step 4: Triggering Policy Sync and Client Evaluation

By default, Intune client devices check in for policy updates every 8 hours. To apply the Windows LAPS policy immediately on a test machine:

1. On the client endpoint, open Settings > Accounts > Access work or school.
2. Select the connected tenant account, click Info, and click Sync.
3. Alternatively, open PowerShell as Administrator and run:

Invoke-LapsPolicyProcessing

The Invoke-LapsPolicyProcessing cmdlet forces the Windows LAPS background engine to query MDM policies, create or locate the target account (ITAdmin), generate an initial password, and write the credential to Microsoft Entra ID.

Step 5: Validating LAPS Policy on the Client Device

Before checking administrative web consoles, verify that the Windows endpoint processed the policy successfully using local diagnostic tools.

1. Inspecting the Windows Registry

When Intune applies the Account Protection policy via Policy CSP, settings are written directly to the Windows Registry under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\LAPS

You can also query this key via PowerShell to automate deployment validation across endpoints:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Policies\LAPS"

The registry confirms that AdministratorAccountName is set to ITAdmin, BackupDirectory is set to 1 (Microsoft Entra ID), PasswordAgeDays is set to 14 (hex 0xe), PasswordLength is set to 8, and AutomaticAccountManagementEnabled is active.

2. Checking the Dedicated Event Viewer Channel

Modern Windows LAPS writes detailed processing diagnostics to its dedicated Windows Event Log channel:

Applications and Services Logs > Microsoft > Windows > LAPS > Operational

As captured in Event ID 10022 on the client, the operating system verifies every applied parameter:

The current LAPS policy is configured as follows:

Policy source: CSP
Backup directory: Azure Active Directory
Local administrator account name: ITAdmin
Password age in days: 14
Password complexity: 3
Password length: 8
Post authentication grace period (hours): 24
Post authentication actions: 0x1
Automatic account management enabled: 1
Automatic account management: Target: CustomAdminAccount
Automatic account management: Name or name prefix: ITAdmin
Automatic account management: Account enabled: 1
Automatic account management: Randomize name: 0

Key Windows LAPS Event IDs

Step 6: Retrieving the Local Administrator Password

Once the endpoint logs Event ID 10029, administrators can retrieve the cleartext password using three separate methods.

Method 1: In the Microsoft Intune Admin Center

1. Go to Devices > Windows > select your target device (such as TechEUC-1).
2. In the device sub-menu under Monitor, click Local admin password.
3. Click Show local administrator password.

Intune opens a flyout pane displaying the managed account name (ITAdmin), Security ID (SID), cleartext password, last rotation timestamp, and the next scheduled rotation date:

Method 2: In the Microsoft Entra Admin Center

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com).
2. Navigate to Devices > All devices.
3. Under the Manage section in the left menu, click Local administrator password recovery.
4. Find your device (e.g. TechEUC-1, TechEUC-2, or TechEUC-3) in the inventory table.
5. Click Show local administrator password.

Method 3: Using Microsoft Graph PowerShell

Helpdesk and automation teams can retrieve passwords programmatically using the Microsoft Graph PowerShell SDK:

Connect-MgGraph -Scopes "DeviceLocalCredential.Read.All"
$device = Get-MgDevice -Filter "displayName eq 'TechEUC-1'"
Get-MgDeviceLocalCredential -DeviceId $device.Id | Select-Object -ExpandProperty Credentials

Step 7: On-Demand Remote Password Rotation

If a technician finishes a troubleshooting session and you want to rotate the credential immediately without waiting for the 14-day cycle or the post-authentication timer:

1. In the Microsoft Intune admin center, navigate to Devices > Windows > select your device.
2. In the top toolbar, click the three horizontal dots (…) to reveal more remote actions.
3. Click Rotate local admin password.
4. Confirm the prompt. Intune sends an immediate push notification to the client endpoint to generate a new password and sync it to Entra ID.

Permissions Required to Access Local Admin Passwords

To follow the principle of least privilege, do not assign Global Administrator roles just to read LAPS passwords. Microsoft Entra ID and Intune support specific granular permissions:

• Intune RBAC: Users need the Managed Devices > Read and Managed Devices > Query Local Administrator Password permissions. This is built into the Endpoint Security Manager and Helpdesk Operator roles.
• Entra ID Built-in Roles: Cloud Device Administrator and Helpdesk Administrator have native read access to recover LAPS passwords.
• Entra ID Custom Role: You can create a scoped custom role with only the microsoft.directory/deviceLocalCredentials/password/read permission for tier-1 support technicians.

Summary Verification Checklist

Need Enterprise Endpoint Security Engineering?

Implementing zero-trust endpoint access and securing local administrator privileges across thousands of Windows workstations requires disciplined policy design. If your organization is transitioning from legacy GPO solutions to modern Microsoft Intune architecture, TechEUC provides specialized enterprise infrastructure engineering. Reach out through our Contact Page to collaborate on your endpoint security initiatives.