Almost every business I review has one password that opens every laptop in the building: the shared local administrator account. Windows LAPS with Intune fixes that by giving each device its own unique, rotating local admin password, backed up to Microsoft Entra ID and visible only to the people who should see it. It is built into Windows, it is included with Intune Plan 1, and it takes an afternoon to roll out properly.
This guide covers why the shared password is such a problem, what Windows LAPS actually does, and the exact steps to deploy it from the Intune admin center without locking your help desk out of anything.
Why the shared local admin password is a real risk
The shared local admin password usually starts innocently. Someone built the first image years ago, set a password for the built-in Administrator account, and every machine since has inherited it. It gets written on a sticky note, saved in a technician’s notes app, shared with a contractor, and never changed because changing it means touching every device.
The problem is what an attacker can do with it. If one laptop is compromised and the attacker pulls the local password hash, that same credential works on every other device with the same password. That is lateral movement made easy. Pass-the-hash attacks rely on exactly this pattern, and once an attacker has admin rights on several machines, ransomware deployment is a short step away.
There is also an offboarding problem. Every IT person, MSP technician and contractor who ever knew that password still knows it. In the tenants I review, the shared password is often older than half the staff.
What Windows LAPS does
Windows Local Administrator Password Solution (Windows LAPS) is built into current versions of Windows 10 and Windows 11. It is not the old Microsoft LAPS MSI that stored passwords in on-premises Active Directory. The modern version is native to the operating system and can store passwords in Microsoft Entra ID, which is what most cloud-first businesses want.
With Intune managing it, Windows LAPS can:
Set password rules for the managed local admin account, including length and complexity.
Rotate passwords on a schedule, so a password that leaks has a short shelf life.
Back up the password to Microsoft Entra ID or on-premises Active Directory (one or the other, not both).
Rotate after use, so once a technician signs in with the password, it changes automatically after a delay you choose.
Allow manual rotation from the Intune admin center as a device action.
Licensing is simple. Microsoft documents that Intune Plan 1 and Microsoft Entra ID Free are enough for the full LAPS feature set. If you have Microsoft 365 Business Premium, E3 or E5, you already have what you need.
Before you start: prerequisites to check
A few things need to be true before the policy will work:
Supported Windows builds. Devices need a Windows 10 22H2 or Windows 11 build that includes the April 2023 LAPS update or later. Fully patched devices are fine.
Join type. Microsoft Entra joined and Microsoft Entra hybrid joined devices are supported for cloud backup. Workplace-joined (registered) personal devices are not.
LAPS enabled in Entra. For Entra joined devices, the tenant setting must be turned on or devices cannot post passwords to the directory.
Admin roles. Creating the policy needs Security baseline permissions in Intune (the built-in Endpoint Security Manager role has them). Reading passwords is a separate, highly privileged right. Plan who gets it.
Step by step: deploy Windows LAPS with Intune
1. Enable LAPS in Microsoft Entra ID
Sign in to the Microsoft Entra admin center as at least a Cloud Device Administrator and go to:
Entra ID > Devices > Overview > Device settings
Set Enable Microsoft Entra Local Administrator Password Solution (LAPS) to Yes and save. Skip this and Entra joined devices will accept the Intune policy but fail to back up their password.
Choose Windows as the platform and Local admin password solution (Windows LAPS) as the profile.
3. Configure the settings
These are the settings I start with for most small and mid-sized businesses:
Setting
Suggested value
Why
Backup Directory
Backup the password to Azure AD only (Entra ID)
Cloud-first devices have no line of sight to a domain controller.
Password Age Days
30
Short enough to limit exposure, long enough to avoid noise.
Administrator Account Name
Leave blank, or a custom account you create
Blank manages the built-in Administrator account by its well-known ID.
Password Complexity
Large letters, small letters, numbers, special characters
Nobody types this from memory, so make it strong.
Password Length
20 or more
Length is cheap when the password is retrieved, not remembered.
Post-authentication Actions
Reset password and log off the managed account
Closes the session and rotates after a technician uses it.
Post-authentication Reset Delay
8 hours
Gives a technician a working day before rotation.
One important note on custom accounts: if you point LAPS at a custom local admin account, LAPS will manage it but will not create it. You need another policy to create that account first. For most businesses, managing the built-in Administrator account is the simpler path.
4. Assign to a pilot group first
Assign the policy to a small device group, including at least one IT machine. Confirm the password appears in Intune under the device’s Local admin password page, then expand to all Windows devices.
5. Remove the old shared password
This is the step people skip. Once LAPS manages the built-in Administrator account, the old shared password is replaced on each device at the next rotation. If your old image also created a second local admin account with the shared password, remove that account or put it under LAPS management. Otherwise you have added LAPS without removing the risk.
Who should be able to read passwords
Retrieving a LAPS password is a privileged action, because it gives full admin rights to that device. Do not hand it to every help desk person by default. A sensible approach:
Create a custom Intune role or Entra role that includes the right to read local admin passwords.
Assign it to a small group of named technicians, ideally through Privileged Identity Management if you have Entra ID P2.
Review the audit logs for password retrieval events every month. Retrievals should line up with real support tickets.
Pair LAPS with strong admin sign-in controls. If the account that can read every local admin password is not protected with phishing-resistant MFA, you have moved the risk rather than reduced it. Our MFA enablement service covers that side.
Common problems and how to fix them
No password visible in Intune. Check the Entra tenant setting first. Then check the device’s event log under Applications and Services Logs > Microsoft > Windows > LAPS > Operational for backup events.
Policy shows as conflicting. Another policy, often an old custom OMA-URI or a security baseline, is configuring the same LAPS settings. Keep one source of truth.
Backup directory set to Active Directory on cloud-only devices. The device accepts the setting but can never complete the backup. Use Entra ID for Entra joined devices.
Legacy LAPS still installed. The Intune CSP takes precedence over legacy LAPS, but clean up the old MSI and Group Policy to avoid confusion.
LAPS works best as part of a wider baseline. If you want the full picture of what your Windows devices should look like, see our Intune endpoint security baseline service, or start with an Intune health check to find gaps like this one.
Does Windows LAPS with Intune need an extra license?
No. Microsoft documents that Intune Plan 1 and Microsoft Entra ID Free are enough. Business Premium, Microsoft 365 E3 and E5 all include Intune Plan 1.
Can I store LAPS passwords in both Entra ID and on-premises Active Directory?
No. A device backs up to one directory type only. Choose Entra ID for Entra joined devices, and either option for hybrid joined devices depending on where your support team works.
What happens to the old shared password after LAPS is deployed?
If LAPS manages the built-in Administrator account, the device replaces the old password with a unique one at the first rotation. Any other local admin accounts that use the shared password are untouched, so find and remove them.
Not sure how many shared admin passwords are still live in your environment? Book a free Microsoft 365 security assessment and we will show you exactly where your device and identity gaps are.
Almost every business I review has one password that opens every laptop in the building: the shared local administrator account. Windows LAPS with Intune fixes that by giving each device its own unique, rotating local admin password, backed up to Microsoft Entra ID and visible only to the people who should see it. It is built into Windows, it is included with Intune Plan 1, and it takes an afternoon to roll out properly.
This guide covers why the shared password is such a problem, what Windows LAPS actually does, and the exact steps to deploy it from the Intune admin center without locking your help desk out of anything.
Why the shared local admin password is a real risk
The shared local admin password usually starts innocently. Someone built the first image years ago, set a password for the built-in Administrator account, and every machine since has inherited it. It gets written on a sticky note, saved in a technician’s notes app, shared with a contractor, and never changed because changing it means touching every device.
The problem is what an attacker can do with it. If one laptop is compromised and the attacker pulls the local password hash, that same credential works on every other device with the same password. That is lateral movement made easy. Pass-the-hash attacks rely on exactly this pattern, and once an attacker has admin rights on several machines, ransomware deployment is a short step away.
There is also an offboarding problem. Every IT person, MSP technician and contractor who ever knew that password still knows it. In the tenants I review, the shared password is often older than half the staff.
What Windows LAPS does
Windows Local Administrator Password Solution (Windows LAPS) is built into current versions of Windows 10 and Windows 11. It is not the old Microsoft LAPS MSI that stored passwords in on-premises Active Directory. The modern version is native to the operating system and can store passwords in Microsoft Entra ID, which is what most cloud-first businesses want.
With Intune managing it, Windows LAPS can:
Licensing is simple. Microsoft documents that Intune Plan 1 and Microsoft Entra ID Free are enough for the full LAPS feature set. If you have Microsoft 365 Business Premium, E3 or E5, you already have what you need.
Before you start: prerequisites to check
A few things need to be true before the policy will work:
Step by step: deploy Windows LAPS with Intune
1. Enable LAPS in Microsoft Entra ID
Sign in to the Microsoft Entra admin center as at least a Cloud Device Administrator and go to:
Entra ID > Devices > Overview > Device settingsSet Enable Microsoft Entra Local Administrator Password Solution (LAPS) to Yes and save. Skip this and Entra joined devices will accept the Intune policy but fail to back up their password.
2. Create the LAPS policy
In the Intune admin center go to:
Endpoint security > Account protection > Create PolicyChoose Windows as the platform and Local admin password solution (Windows LAPS) as the profile.
3. Configure the settings
These are the settings I start with for most small and mid-sized businesses:
One important note on custom accounts: if you point LAPS at a custom local admin account, LAPS will manage it but will not create it. You need another policy to create that account first. For most businesses, managing the built-in Administrator account is the simpler path.
4. Assign to a pilot group first
Assign the policy to a small device group, including at least one IT machine. Confirm the password appears in Intune under the device’s Local admin password page, then expand to all Windows devices.
5. Remove the old shared password
This is the step people skip. Once LAPS manages the built-in Administrator account, the old shared password is replaced on each device at the next rotation. If your old image also created a second local admin account with the shared password, remove that account or put it under LAPS management. Otherwise you have added LAPS without removing the risk.
Who should be able to read passwords
Retrieving a LAPS password is a privileged action, because it gives full admin rights to that device. Do not hand it to every help desk person by default. A sensible approach:
Pair LAPS with strong admin sign-in controls. If the account that can read every local admin password is not protected with phishing-resistant MFA, you have moved the risk rather than reduced it. Our MFA enablement service covers that side.
Common problems and how to fix them
Applications and Services Logs > Microsoft > Windows > LAPS > Operationalfor backup events.LAPS works best as part of a wider baseline. If you want the full picture of what your Windows devices should look like, see our Intune endpoint security baseline service, or start with an Intune health check to find gaps like this one.
Microsoft’s reference for this policy is here: Microsoft Intune support for Windows LAPS.
Frequently asked questions
Does Windows LAPS with Intune need an extra license?
No. Microsoft documents that Intune Plan 1 and Microsoft Entra ID Free are enough. Business Premium, Microsoft 365 E3 and E5 all include Intune Plan 1.
Can I store LAPS passwords in both Entra ID and on-premises Active Directory?
No. A device backs up to one directory type only. Choose Entra ID for Entra joined devices, and either option for hybrid joined devices depending on where your support team works.
What happens to the old shared password after LAPS is deployed?
If LAPS manages the built-in Administrator account, the device replaces the old password with a unique one at the first rotation. Any other local admin accounts that use the shared password are untouched, so find and remove them.
Not sure how many shared admin passwords are still live in your environment? Book a free Microsoft 365 security assessment and we will show you exactly where your device and identity gaps are.