One local administrator password across the estate means one compromised machine is all of them.
Windows LAPS automatically manages and backs up the local administrator password per device, on Entra joined or Active Directory joined machines. Microsoft lists protection against pass the hash and lateral traversal first among its benefits, which is exactly the problem a shared password creates.
- FreeThe feature itself, on all supported Windows
- Per deviceA distinct password, rotated automatically
- Entra or ADBackup destination, and only one of them
- DeprecatedLegacy Microsoft LAPS, from Windows 11 23H2
Eight things to establish before you deploy it.
A managed password per device
Windows LAPS automatically manages and backs up the password of a local administrator account on Entra joined or Active Directory joined devices. Each machine gets its own, rotated on a schedule, so the credential recovered from one endpoint opens nothing else.
The attack it directly addresses
Microsoft lists protection against pass the hash and lateral traversal attacks first among the benefits. A shared local administrator password is one of the shortest paths from a single compromised workstation to the whole estate, and this closes it structurally rather than by detection.
Join state decides where passwords go
Devices joined only to Entra ID back up only to Entra ID. Devices joined only to Active Directory back up only to Active Directory. Hybrid joined devices can use either. You cannot back up to both, and workplace joined clients are not supported at all.
How stored passwords are protected
For Active Directory, a fine-grained security model using access control lists and optional password encryption. For Entra ID, the Entra role-based access control model. Both mean retrieval is a permissioned action with a record rather than a shared secret in a document.
Password history, which legacy LAPS never had
Windows LAPS can store password history. That matters for recovery: restoring a machine from a backup taken before the last rotation leaves it expecting an older password, and without history that device becomes unreachable through the account you were relying on.
The legacy product is deprecated
Legacy Microsoft LAPS is deprecated as of Windows 11 23H2 and later. Installation of its MSI package is blocked on newer operating system versions and Microsoft no longer considers code changes for it. Support continues on older versions only until their normal end of support.
Migration from legacy is supported deliberately
Windows LAPS does not require legacy Microsoft LAPS to be installed and can be fully deployed without it. For organisations with an existing legacy deployment, Windows LAPS offers a legacy Microsoft LAPS emulation mode specifically to help migrate rather than cut over abruptly.
Domain controllers get covered too
Windows LAPS can automatically manage and back up the Directory Services Restore Mode account password on Active Directory domain controllers. That password is otherwise set once during promotion and frequently never changed again, which makes it one of the older secrets in most estates.
A device backs up to Entra ID or to Active Directory. Never both.
Join state determines what is possible, and hybrid estates are where the decision actually has to be made.
- Devices joined only to Entra ID can back up passwords only to Entra ID. Devices joined only to Active Directory can back up only to Active Directory. Hybrid joined devices can back up to either, and Microsoft states plainly that you cannot back up passwords to both.
- Microsoft Entra workplace joined clients are not supported at all. In estates where personal or lightly managed devices are workplace joined, those machines fall outside this control entirely and need a different answer rather than an assumption of coverage.
- For hybrid estates the choice usually turns on who needs to retrieve the password. Entra ID backup uses the Entra role-based access control model and suits a help desk working from the cloud portal. Active Directory backup uses access control lists with optional encryption and suits a team already operating there.
- Licensing rarely constrains the decision. The feature itself is free on all supported Windows platforms, backing up to Active Directory has no additional licensing requirement, and backing up to Entra ID needs only Entra ID Free or higher.
Four things that make a LAPS deployment stick.
We design retrieval before we design rotation
A rotated password nobody can retrieve is an outage waiting to happen, and the workaround people find is a second local account with a password everybody knows. Getting the Entra role-based access control model or the Active Directory access control lists right first is what prevents that.
We settle the destination question per device group
Entra joined devices can only back up to Entra ID, Active Directory joined devices only to Active Directory, and hybrid devices to either but never both. In mixed estates that is a real design decision, and making it explicitly avoids a half-deployed state nobody notices.
We keep password history for the restore case
A machine restored from a backup predating the last rotation expects the old password. Windows LAPS stores password history, which legacy Microsoft LAPS did not, and configuring it is the difference between recovering that device and rebuilding it.
We migrate legacy rather than running both
Legacy Microsoft LAPS is deprecated as of Windows 11 23H2, its installer is blocked on newer operating systems and Microsoft no longer makes code changes to it. Emulation mode exists to make migration orderly, and it is a better answer than leaving two products managing the same accounts.
Four phases across roughly four to six weeks.
- 01Week 1
Establish join state, versions and current practice
Which devices are Entra joined, Active Directory joined, hybrid or workplace joined, whether every machine has the April 2023 update or later, and what the current local administrator password practice actually is. That last answer is frequently uncomfortable.
- Join state inventory across the estate
- Windows version and update level confirmed
- Workplace joined devices identified as out of scope
- Current local administrator password practice documented
- 02Week 2
Design the backup destination and retrieval model
Entra ID or Active Directory per device group, with the constraint that it cannot be both. Then who is permitted to retrieve a password, through which model, and with what record. This is where the help desk process is designed rather than assumed.
- Backup destination decided per device group
- Retrieval permissions designed using RBAC or ACLs
- Password encryption decision recorded for Active Directory
- Password history retention agreed
- 03Weeks 3 to 4
Deploy by policy and validate retrieval
Policy applied through the Windows LAPS configuration service provider or Group Policy, then the part organisations skip: actually retrieving a password and using it, from the account of somebody who will need to do it at three in the morning.
- Policy deployed to a pilot group
- Password backup confirmed in the chosen directory
- Retrieval tested by help desk staff, not by the project team
- Event log channel monitored for failures
- 04Weeks 5 to 6
Broaden, retire legacy and cover domain controllers
Rollout across the estate, migration away from legacy Microsoft LAPS using emulation mode where an existing deployment exists, and extension to the Directory Services Restore Mode password on domain controllers.
- Full estate coverage achieved and measured
- Legacy Microsoft LAPS migrated and retired
- DSRM password management enabled on domain controllers
- Coverage reporting handed to the operational team
Six situations where local administrator passwords are the exposure.
A business built from a standard image
Every machine deployed from the same image carries the same local administrator password, and that password has usually not changed since the image was built. It is the most common finding in an endpoint review and among the fastest to fix once identified.
A regulated firm asked about lateral movement controls
Microsoft lists protection against pass the hash and lateral traversal attacks as the first benefit. Being able to state that every device has a distinct, automatically rotated local administrator password with permissioned retrieval is a direct and verifiable answer.
An operator with machines that are rarely online
Site terminals and remote equipment go long periods without connecting, which makes password history and a reliable retrieval process more important than in a well-connected office estate. It also makes the recovery scenario the one that actually gets used.
A provider recovering an inaccessible device
Microsoft lists the ability to sign in to and recover devices that are otherwise inaccessible as a benefit in its own right. For clinical equipment where a rebuild is not a quick option, having a retrievable local administrator credential is an availability control as much as a security one.
An organisation still running legacy Microsoft LAPS
The legacy product is deprecated, its installer is blocked on newer Windows versions and Microsoft no longer considers code changes for it. Migration is not urgent in the sense of a hard deadline, and it is on a path with a known end. Emulation mode makes the move orderly.
A company that has never changed its DSRM password
The Directory Services Restore Mode password is set during domain controller promotion and in many estates has never been changed since. Windows LAPS can manage and back it up automatically, which turns one of the oldest secrets in the environment into a managed one.
How UAE organisations handle local administrator passwords.
| Feature | Windows LAPS deployed | Legacy Microsoft LAPS | Shared password |
|---|---|---|---|
Unique password per device | Yes | Yes | No |
Automatic rotation | Yes | Yes | No |
Backup to Entra ID | Yes | No | Not applicable |
Password encryption in Active Directory | Optional | No | Not applicable |
Password history stored | Yes | No | Not applicable |
Retrieval permissioned and recorded | Yes | Yes | No |
DSRM password managed | Yes | No | No |
Product actively developed | Yes | Deprecated | Not applicable |
Lateral movement from one endpoint | Blocked at this vector | Blocked at this vector | Trivial |
Additional licence cost | None | None | None |
Where Windows LAPS is available, and where it is not.
| Platform or state | Support position | |
|---|---|---|
| Windows 11 23H2 and later | Supported | |
| Windows 11 22H2 and 21H2 | Supported with the April 11 2023 update or later | |
| Windows 10 | Supported with the April 11 2023 update or later | |
| Windows Server 2025 and later | Supported | |
| Windows Server 2022 and 2019 | Supported with the April 11 2023 update or later | |
| Automatic Account Management CSP settings | Require Windows 11 24H2 or later | |
| Entra joined devices | Back up to Entra ID only | |
| Active Directory joined devices | Back up to Active Directory only | |
| Hybrid joined devices | Either destination, never both | |
| Entra workplace joined clients | Not supported |
Five steps, and the retrieval test is the one that matters.
- 1
Establish join state and Windows version coverage
Entra joined, Active Directory joined, hybrid and workplace joined counted separately, since the first three determine the backup destination and the fourth is not supported. Windows version and update level confirmed, since support came through the April 2023 update.
- 2
Decide the backup destination per device group
Entra ID or Active Directory, never both. For hybrid estates the decision usually follows who retrieves passwords day to day, since Entra backup uses Entra role-based access control and Active Directory backup uses access control lists with optional encryption.
- 3
Design retrieval permissions and history
Who may retrieve a password, through which model, and with what record. Password history configured deliberately, because a device restored from an older backup expects an older password and history is what makes that recoverable.
- 4
Deploy and have the help desk test it
Policy applied through the configuration service provider or Group Policy to a pilot group, backup confirmed in the chosen directory, and retrieval tested by the people who will actually do it rather than by whoever configured it.
- 5
Broaden, migrate legacy and cover domain controllers
Full estate rollout with coverage measured rather than assumed, legacy Microsoft LAPS migrated using emulation mode and retired, and Directory Services Restore Mode password management enabled on domain controllers.
What organisations ask about Windows LAPS.
Fifteen questions worth answering first.
Estate
- What is the join state of each device group?It decides the destination.
- Are all devices on the April 2023 update or later?Or Windows 11 23H2 plus.
- Do we have workplace joined clients?They are not supported.
- Are domain controllers in scope?DSRM can be managed too.
- Do we still run legacy Microsoft LAPS?It is deprecated.
Design
- Entra ID or Active Directory backup?Never both.
- Will we encrypt passwords in Active Directory?It is optional.
- How much password history do we keep?It helps with restores.
- Policy by CSP or Group Policy?Both are supported.
- Which local account are we managing?Decide deliberately.
Operations
- Who is permitted to retrieve a password?By RBAC or ACL.
- Has a real help desk agent tested retrieval?Not the project team.
- Is the event log channel monitored?Failures surface there.
- What happens when a device is offline for months?History matters.
- How do we measure coverage?A number, not an assumption.
Check whether two randomly chosen machines share a local administrator password.
If they do, one compromised endpoint is every endpoint. Windows LAPS is free on every supported Windows platform, and this is the fix.
Related Services
Explore more solutions that work great with this service
Endpoint Privilege Management
Remove local admin rights without breaking the two apps that need it
Privileged Identity Management
Just-in-time admin access, approval, and audit history you can download
Active Directory Audit
Privilege paths, service accounts and local admin passwords
Privileged Access Audit
Every privileged path, not just the admin list
Security Baselines
Why deploying one does not make you CIS compliant
Endpoint Security
Defender for Endpoint and Intune managed
Microsoft Entra
Identity and access management solutions
Microsoft Security Dubai
Entra, Defender, Purview, Sentinel, and what you already own