Shared Local Admin Passwords Are a Lateral Movement Gift. LAPS Ends That.

An attacker who lands on one workstation and finds a local admin password does the obvious next thing: tries it everywhere else. If that password is the same across the fleet, and in many environments it still is, one phished user becomes a company-wide incident in an afternoon.

That reused password is one of two habits that keep local admin accounts dangerous. The other is letting end users run as local administrators on their own machines. It feels convenient, and it hands malware, ransomware, and malicious browser extensions elevated privileges the moment a user clicks the wrong thing.

MSPs often work around the first problem by storing per-device passwords in a documentation tool like IT Glue. That helps, but we would argue letting Microsoft manage these passwords is the better and more secure option. The tool for the job is Microsoft's Local Administrator Password Solution, and as of October 2025 it is built into Windows and Intune.

What does Windows LAPS actually do?#

LAPS is a built-in capability of Windows and Microsoft Intune that manages local administrator passwords across your devices automatically. Think of it as a password manager for endpoints, run through Intune and Entra ID (formerly Azure AD) instead of a browser extension.

With LAPS you can:

• Give every device a unique local admin password, managed securely.
• Rotate passwords automatically on a schedule, or immediately after the account is used.
• Store passwords in Entra ID so only authorized users can retrieve them.

It also lets you convert existing local administrator accounts into standard user accounts, which tightens posture without breaking anyone's day-to-day work.

Check these prerequisites before you build anything#

Three things to confirm up front.

Licensing. You need Microsoft Entra ID Free or higher and a Microsoft Intune license. Microsoft 365 Business Premium is ideal because it includes both.

Device join state. Devices must be Entra joined or hybrid joined. Entra registered devices are not supported.

Windows version. Several newer capabilities, including automatic account management, require Windows 11 24H2 or later. Microsoft's overview is here: Use Windows Local Administrator Password Solution (LAPS) with Microsoft Entra ID (opens in new tab).

One tip that saves real troubleshooting time: read the LAPS CSP documentation (opens in new tab) before rollout. It lists each policy alongside the OS versions that support it, so you find out about version gaps before deployment instead of after.

Deploying LAPS through Intune in three steps#

Step 1: Flip the tenant-level switch in Entra#

1. Go to Entra Admin Center → Devices → Device Settings.
2. Set "Enable Microsoft Entra Local Administrator Password Solution (LAPS)" to Yes.
3. While you are on that page, consider two related settings:
   • "Add Global Admins as local admins" → No
   • "Add users joining the device as local admins" → None

Those last two ensure users land as standard users, not local admins, during enrollment. That matters most when you provision through Windows Autopilot, where the join happens without a tech in the room.

Step 2: Build the LAPS policy in Intune#

1. Open Intune Admin Center → Endpoint Security → Account Protection.
2. Click + Create Policy.
3. Platform: Windows 10 and later.
4. Profile: Local Administrator Password Solution (LAPS).

Name the policy something you will recognize in six months, like "LAPS – Standard Devices", then configure the settings. Our recommendations:

With automatic account management enabled, this policy creates and manages a unique local admin account on each device for you, scheduled rotations included. No script, no manual account creation.

Step 3: Assign to a pilot group and deploy#

Assign the policy to a device group. Start with a test group, such as your Windows Autopilot devices, rather than the whole fleet. Click Create to deploy.

How do you confirm LAPS is working?#

On a target machine, open Local Users and Groups. You should see a new admin account, something like CC-Labs-1234, created and managed by LAPS.

Then verify the server side. In the Intune Admin Center, go to Devices → [Device Name] → Local admin password. You will see:

• The account name
• The current password, hidden until an authorized admin reveals it
• The last and next password rotation dates

Need a rotation outside the schedule? Open the device's three-dot menu and choose Rotate local admin password. Useful after a tech session, an offboarding, or anything that makes you doubt who has seen the current password.

The bigger picture#

LAPS gives you a scalable, cloud-native answer to a problem that manual rotation and shared passwords never solved. Combine it with standard user permissions for end users and you have closed the two most common local admin gaps in one project. We consider it a foundational control for modern endpoint security, not an optional extra.