Windows LAPS is a built in Windows feature that rotates the local administrator password on each device and backs it up to Microsoft Entra ID or Active Directory. It ends the shared local admin password that lets an attacker move from one machine to the next.
Why shared local admin passwords hurt
Microsoft's overview points out that local administrator accounts often share the same password across many devices, which bad actors can exploit to move laterally. If one laptop is compromised and its local admin hash or password works everywhere, one incident becomes a fleet incident.
Windows LAPS regularly rotates each device's local administrator password, stores it securely, and lets authorized administrators retrieve it to sign in to or recover a device. Microsoft lists protection against pass-the-hash and lateral traversal attacks among the benefits, along with safer remote help desk work.
Where passwords can be stored
The device join state decides the options:
- Entra joined only: back up to Microsoft Entra ID.
- Active Directory joined only: back up to Windows Server Active Directory.
- Hybrid joined: either one, but not both.
- Domain controllers: the Directory Services Restore Mode password can be backed up to Active Directory.
Workplace joined Entra clients are not supported.
In Active Directory, native Windows LAPS can encrypt stored passwords and keep a password history. In Entra ID, access follows Entra role based access control.
Supported platforms
On the client side, Windows 11 23H2 and later include it, and Windows 10 and earlier Windows 11 releases got it with the April 11, 2023 update. Windows 10 reached end of support on October 14, 2025, and Microsoft says Windows LAPS remains available on Windows 10 only where devices keep receiving updates, such as under Extended Security Updates.
On servers, Windows Server 2025 includes it, and Windows Server 2022 and 2019 received it with the April 2023 update. The automatic account management settings need Windows 11 24H2 or later, or Windows Server 2025 or later.
The feature costs nothing on supported Windows. Backing up to Active Directory needs no extra license. Backing up to Entra ID needs an Entra ID Free or higher license.
Policy and management
You can configure it through the Windows LAPS configuration service provider, through Group Policy, or through legacy emulation mode during migration. Monitoring options include the Active Directory Users and Computers properties dialog, a dedicated event log channel, and a PowerShell module specific to Windows LAPS.
Legacy LAPS
The older Microsoft LAPS product is deprecated as of Windows 11 23H2 and later, and newer OS versions block its installer. Emulation mode honors existing legacy policy settings during migration, but it stores passwords in Active Directory in clear text form and cannot use encryption or history. Treat it as a bridge.
Rollout notes for engineering teams
- Decide where passwords live, based on your join state.
- Choose which account to manage. A dedicated, renamed local admin account is easier to reason about than the built in one.
- Set a rotation interval and a post authentication action, so a used password is rotated after someone retrieves it.
- Restrict who can read passwords. Treat the read permission as privileged.
- Test the recovery flow on a pilot device before you need it at 2 a.m.
Developers on managed laptops should not expect a permanent local admin password. If a task needs elevation, use the sanctioned process and keep daily work in a standard account.
Quick check
Can a hybrid joined device back up to both Entra ID and Active Directory?
No. Microsoft says you can back up to one or the other, not both.
Is legacy LAPS still the right choice for new deployments?
No. Microsoft deprecates it on newer Windows versions and recommends native Windows LAPS, which also adds encryption and password history for Active Directory.
Sources
Last reviewed: 19 October 2026.
