How to Set Up Windows LAPS with Microsoft Intune 

• Go to Microsoft Intune admin center > head to Endpoint Security > Account Protection > Click on + Create Policy > Set Windows 10 and later for the platform, then select Local admin password solution (Windows LAPS) (preview) for the Profile > Click Create.

• On the Create Profile page on Basics, you can add a name for the profile. You can also add a description to the profile to give a brief summary and purpose for the policy. 

• On Configuration settings, we will configure the settings we will apply to our Intune managed devices. 

Before we start pushing buttons and configuring our settings, let’s learn a little bit about what this all means on this page. 

Backup Directory – Here, we are going to tell the machine where to store the password. In my case, I want to back up the password to Microsoft Entra ID only. 

💡 You can only pick one choice where to store the password. 

Password Age Days – In this section, we will set the password age of the local administrator before we rotate the password and store the new one in Microsoft Entra ID. In this case, the local administrator password will rotate after 30 days. 

Administrator Account Name – This setting allows you to specify the name of the managed local administrator account. If no name is specified it will use the built-in local administrator account located well-known SID. 

Password Complexity – This setting will allow us to control the complexity of the managed local administrator account. In my scenario we want to make it harder for our attackers, so we will set our complexity to use Large letters + small letters + numbers + special characters. 

Password Length – This setting will allow us to set the length for the managed local administrator account. Here by default when configured the password length is 14. 

Post Authentications Actions – This setting will be used to configure what happens to the password after someone has authenticated using the local administrator account. This means after the managed local administrator password is used, run the post actions. Here I told the Post Authentication Actions to Reset the password and logoff the managed account; upon expiry of the grace period (24 hours later), the managed account password will be reset. 

Post Authentication Reset Delay – This setting is used to specify how long to wait after running the Post authentications actions. In my case I gave it a 24-hour grace period, after 24 hours it’s going to run the post authentication action. 

Final Configuration Setting for Windows LAPS Policy 

We won’t make any changes on the Scope tags page > Click Next.

In the Assignments sections, you can assign this policy to a group, All users or All devices. I will select to apply this policy to All devices. 

In the Review + create section, double check your policy to make sure it fulfills your need before creating. If it looks good go ahead and click on Create. 

Let’s again trust but verify that our device has received these configurations. Let’s go into our Account Protection policy and check the report. I have an Intune managed device that is called CPC-01 and it looks like it has succeeded. 

Let’s go a little deeper and go to that device to verify locally that it has received those configurations. We can go to the registry editor and add this path to view what’s been written in the registry. 

HKLM\\Software\\Microsoft\\Policies\\LAPS 

Here we can see information such as our Password Age Days where we set it to 30, Password length where we set it to 14 and our BackupDirectory value of 1 which is Microsoft Entra ID etc. 

How to View a Device’s Local Administrator Password 

We will try to access the managed Local Administrator password two ways with Microsoft Entra ID and the Microsoft Intune Portal. Make sure to at least have one of the following built-in roles (Global Administrator, Cloud Administrator or Intune Administrator) to access that information. 

Microsoft Entra admin center 

Go to Microsoft Entra admin center > Identity > Devices > All devices > 

Click on Local Administrator password recovery (Preview) > 

Click Show local administrator password on the device you want to retrieve the local administrator password for > Click on show to view Local administrator password. 

Microsoft Intune admin center 

Go to Microsoft Intune admin center > Devices > Windows > 

Click on your Windows device you want to retrieve the local administrator password for > select Local admin password. 

Click on Show local administrator password > click on Show to view Local administrator password.

Let’s put this Local Administrator Password to work on an actual device! 

Let’s run PowerShell as an administrator. 

You’ll then view the UAC Prompt asking for administrator credentials > add .\Administrator to run with the local administrator account and add the local administrator password retrieved from either Intune or Entra.

Completed: How to Set Up Windows LAPS with Microsoft Intune

Boom! There we go the king of jungle the administrator! 

Bonus Tip: Change Windows LAPS password on demand. 

Go to Microsoft Intune admin center > Devices > All devices > Click on your device you want to change the LAPS password > go to the 3 dots > Rotate local admin password. 

Read the prompt and select Yes (At your own risk) .

Success!