One local administrator password across the estate means one compromised machine is all of them.
Give every machine its own local administrator password, rotate it on a schedule, and keep a copy somewhere your help desk can actually reach it. That is the whole feature, it works on machines joined to Entra ID or to Active Directory, and the benefit Microsoft names first is exactly the failure a shared password guarantees: pass-the-hash and lateral traversal.
- FreeThe feature itself, on all supported Windows
- Per deviceA distinct password, rotated automatically
- Entra or ADBackup destination, and only one of them
- DeprecatedLegacy Microsoft LAPS, from Windows 11 23H2
Eight things to establish before you deploy it.
A managed password per device
The password on a local administrator account gets managed and backed up automatically, on anything joined to Entra ID or to your domain. Every endpoint ends up holding a different one, rotated to a schedule, which means whatever an attacker pulls off the first machine they land on will not open the second.
The attack it directly addresses
Top of the published benefits list sits protection against pass-the-hash and lateral traversal. Consider why. One password shared across every workstation is about the shortest route there is between a single phished laptop and your entire environment, and this removes the route rather than waiting to notice somebody using it.
Join state decides where passwords go
A cloud-only machine has exactly one destination available to it, and so does a domain-only machine. Only hybrid joined hardware gets a genuine choice, and even then it is a choice of one, because backing up to both directories is not something the product will do. Workplace joined clients get nothing at all here.
How stored passwords are protected
Two different models depending where the password lands. On the domain side, granular access control lists plus encryption if you want it. On the cloud side, the role-based access control you already use for everything else. What both give you is the same thing: pulling a password becomes a permissioned action that leaves a trace, instead of a value sitting in a spreadsheet somebody shared in 2021.
Password history, which legacy LAPS never had
History is stored, and the reason to care is recovery rather than audit. Restore a machine from an image captured before the most recent rotation and that machine is still expecting the previous password. No history means no way in through the very account you deployed this to guarantee access with, which is a uniquely frustrating way to lose a device.
The legacy product is deprecated
The old add-on reached deprecation at Windows 11 23H2. Its installer will not run on newer builds, and no further code changes are being considered for it. Whatever support remains applies only to older Windows versions and expires when those versions do, so it is a position with a published end date rather than an indefinite one.
Migration from legacy is supported deliberately
Nothing about the modern feature depends on the old one being present, so a fresh deployment simply ignores it. Where a legacy install already exists, there is an emulation mode built specifically for that situation, which lets you move across in stages rather than switching everything one evening and hoping.
Domain controllers get covered too
The Directory Services Restore Mode account on your domain controllers can be managed and backed up the same way. Think about when that password was last set. Somebody typed it during promotion, wrote it down or did not, and it has sat unchanged ever since, which makes it comfortably one of the oldest live secrets anywhere in the environment.
A device backs up to Entra ID or to Active Directory. Never both.
How a machine is joined dictates what options it has. For most estates that means the decision makes itself, and it is only the hybrid population where somebody genuinely has to choose.
- Cloud-only machines have one destination. Domain-only machines have the other. Hybrid joined hardware can use whichever you prefer, singular, because the documentation is unambiguous that backing up to both directories is not supported.
- Workplace joined clients are excluded outright. Wherever personal or lightly managed hardware sits in that state, it falls entirely outside this control, and the useful thing to do is write those machines down as uncovered rather than letting an existing tenant policy create the impression they are handled.
- For the hybrid group, decide it on who does the retrieving. A help desk living in the cloud portal all day is better served by cloud backup and its role-based model. A team already comfortable in the directory, working with access control lists and possibly encryption, is better served staying there.
- Cost almost never enters into it. The capability is free across every supported Windows platform, storing passwords in the directory carries no extra licensing at all, and the cloud destination asks for nothing beyond the free tier.
Four things that make a LAPS deployment stick.
We design retrieval before we design rotation
Rotation without accessible retrieval is simply an outage you have scheduled in advance, and the workaround your team will reach for undoes the entire exercise. Settling the permission model first, whether that is cloud roles or directory access control lists, is what stops the workaround ever becoming necessary.
We settle the destination question per device group
Two thirds of your estate has no choice to make, and the hybrid third has one choice that excludes the other. In a genuinely mixed environment that amounts to a real design decision, and taking it deliberately is what prevents the half-finished rollout that nobody spots for a year.
We keep password history for the restore case
Any machine brought back from an image older than the last rotation is going to want the previous password. Storing history is something the modern feature does and the old add-on never could, and having it configured is the difference between recovering that device in ten minutes and rebuilding it from scratch.
We migrate legacy rather than running both
The old product is deprecated, will not install on current builds, and receives no further development. An emulation mode was provided precisely so the move can be made in an orderly way, and taking it is considerably better than the alternative, which is two separate products with opinions about the same account.
Four phases across roughly four to six weeks.
- 01Week 1
Establish join state, versions, and current practice
We sort the estate by join state, confirm the update level is high enough for the feature to exist at all, and then establish how local administrator passwords are being handled today. That third question is the one that produces silence in the room, and it is usually the most useful answer of the week.
- Join state inventory across the estate
- Windows version and update level confirmed
- Workplace joined devices identified as out of scope
- Current local administrator password practice documented
- 02Week 2
Design the backup destination and retrieval model
A destination gets chosen for each group of machines, subject to the one-or-the-other constraint. Then the harder half: which people may pull a password, under which permission model, and what gets recorded when they do. This is the week where the help desk workflow is actually designed instead of being left to work itself out.
- Backup destination decided per device group
- Retrieval permissions designed using RBAC or ACLs
- Password encryption decision recorded for Active Directory
- Password history retention agreed
- 03Weeks 3 to 4
Deploy by policy and validate retrieval
The policy goes out through the configuration service provider or through Group Policy, and then comes the step almost everybody skips. Somebody retrieves a real password and signs in with it, using the account of a person who will one day be doing this at three in the morning with a director on the phone.
- Policy deployed to a pilot group
- Password backup confirmed in the chosen directory
- Retrieval tested by help desk staff, not by the project team
- Event log channel monitored for failures
- 04Weeks 5 to 6
Broaden, retire legacy, and cover domain controllers
The policy widens across the estate, any existing legacy deployment is moved across using emulation mode and then decommissioned properly, and the Directory Services Restore Mode password on your domain controllers is brought into the same management.
- Full estate coverage achieved and measured
- Legacy Microsoft LAPS migrated and retired
- DSRM password management enabled on domain controllers
- Coverage reporting handed to the operational team
Six situations where local administrator passwords are the exposure.
A business built from a standard image
Deploy a thousand machines from one image and all thousand share a local administrator password, typically the one chosen on the afternoon the image was built. This is the single most frequent finding in an endpoint review, and it is also among the quickest things on the report to actually close.
A firm asked about lateral movement controls
Pass-the-hash and lateral traversal protection heads the published benefit list, which matters because insurers, SOC 2 auditors and anyone running a NIST CSF assessment now put the question in writing. Answering that every endpoint holds its own automatically rotated credential, retrievable only by named people, is direct and checkable. Answering anything else invites follow-up questions you would rather not have.
An operator with machines that are rarely online
Terminals on a plant floor and equipment at unstaffed sites can go weeks without checking in, which raises the stakes on both password history and a retrieval process that works first time. In these environments the recovery case is not the edge case, it is the one your team performs most often.
A provider recovering an inaccessible device
Being able to sign in to and recover a machine that is otherwise unreachable is named as a benefit on its own terms. On clinical hardware, where rebuilding means revalidation and a device out of service for days, holding a retrievable local credential functions as an availability control every bit as much as a security one.
An organization still running legacy Microsoft LAPS
Deprecated, blocked from installing on current builds, and receiving no further development. There is no hard deadline forcing your hand this quarter, which is exactly why it keeps slipping down the list, but the path it is on has a known end point. Emulation mode is there to make the transition unremarkable.
A company that has never changed its DSRM password
Somebody set that password while promoting a domain controller, possibly before the current IT manager was hired, and in a great many environments nothing has touched it since. Bringing it under automatic management and backup converts the oldest surviving secret in the building into an ordinary managed credential.
How US organizations handle local administrator passwords.
| Feature | Windows LAPS deployed | Legacy Microsoft LAPS | Shared password |
|---|---|---|---|
Unique password per device | Yes | Yes | No |
Automatic rotation | Yes | Yes | No |
Backup to Entra ID | Yes | No | Not applicable |
Password encryption in Active Directory | Optional | No | Not applicable |
Password history stored | Yes | No | Not applicable |
Retrieval permissioned and recorded | Yes | Yes | No |
DSRM password managed | Yes | No | No |
Product actively developed | Yes | Deprecated | Not applicable |
Lateral movement from one endpoint | Blocked at this vector | Blocked at this vector | Trivial |
Additional license cost | None | None | None |
Where Windows LAPS is available, and where it is not.
Platform or state
Windows 11 23H2 and later
- Support position
- Supported
Platform or state
Windows 11 22H2 and 21H2
- Support position
- Supported with the April 11 2023 update or later
Platform or state
Windows 10
- Support position
- Supported with the April 11 2023 update or later
Platform or state
Windows Server 2025 and later
- Support position
- Supported
Platform or state
Windows Server 2022 and 2019
- Support position
- Supported with the April 11 2023 update or later
Platform or state
Automatic Account Management CSP settings
- Support position
- Require Windows 11 24H2 or later
Platform or state
Entra joined devices
- Support position
- Back up to Entra ID only
Platform or state
Active Directory joined devices
- Support position
- Back up to Active Directory only
Platform or state
Hybrid joined devices
- Support position
- Either destination, never both
Platform or state
Entra workplace joined clients
- Support position
- Not supported
Five steps, and the retrieval test is the one that matters.
- 1
Establish join state and Windows version coverage
Four populations get counted individually, because three of them determine where passwords will be stored and the fourth cannot participate at all. Alongside that we confirm build and update level on every machine, given that the capability arrived through a servicing update rather than an OS upgrade.
- 2
Decide the backup destination per device group
One destination or the other, and for the hybrid population the deciding factor is almost always operational rather than architectural: who pulls passwords day to day and which console they already live in. The permission models differ between the two, so matching the destination to your team saves friction later.
- 3
Design retrieval permissions and history
Three questions get settled: who is allowed to pull a password, under what permission model, and what evidence exists afterwards that they did. History gets configured as a deliberate choice rather than left at whatever the default happens to be, because a restored machine wanting a superseded password is the scenario history exists for.
- 4
Deploy and have the help desk test it
A pilot group receives the policy by whichever mechanism suits, we confirm passwords are genuinely landing in the chosen directory, and then a real help desk agent retrieves one and uses it. Not the engineer who built the configuration, who already knows where everything is.
- 5
Broaden, migrate legacy, and cover domain controllers
The rollout widens with coverage reported as a measured figure instead of an assumption, any legacy deployment moves across through emulation mode and is then properly retired, and the restore mode password on your domain controllers comes under management as the final step.
What organizations ask about Windows LAPS.
Fifteen questions worth answering first.
Estate
- What is the join state of each device group?It decides the destination.
- Are all devices on the April 2023 update or later?Or Windows 11 23H2 plus.
- Do we have workplace joined clients?They are not supported.
- Are domain controllers in scope?DSRM can be managed too.
- Do we still run legacy Microsoft LAPS?It is deprecated.
Design
- Entra ID or Active Directory backup?Never both.
- Will we encrypt passwords in Active Directory?It is optional.
- How much password history do we keep?It helps with restores.
- Policy by CSP or Group Policy?Both are supported.
- Which local account are we managing?Decide deliberately.
Operations
- Who is permitted to retrieve a password?By RBAC or ACL.
- Has a real help desk agent tested retrieval?Not the project team.
- Is the event log channel monitored?Failures surface there.
- What happens when a device is offline for months?History matters.
- How do we measure coverage?A number, not an assumption.
Check whether two randomly chosen machines share a local administrator password.
If they do, one compromised endpoint is every endpoint. Windows LAPS is free on every supported Windows platform, and this is the fix.
Related Services
Explore more solutions that work great with this service
Microsoft Entra Privileged Identity Management
Privileged Identity Management deployment for US organizations:
Learn moreActive Directory Security Audit
On-premises Active Directory security audit for US organizations:
Learn morePrivileged Access Audit
Privileged access audits for US organizations: enumeration of every
Learn moreIntune Security Baselines
Security baseline design and management for US organizations: stating
Learn moreEndpoint Security
Endpoint security for US businesses using Microsoft Defender for
Learn moreMicrosoft Entra
Identity and access management solutions
Learn more