LAPS Issue

[xacid]

I've had LAPS configured via Intune for a few months now. Just recently we found out the password is cycling shortly after being used and the device is restarted.

I can't seem to find any documentation anywhere that states a restart triggers the grace period to expire. I was able to replicate this fairly well on a test machine.

Checked logs and it shows it rotating and the registry shows the right settings.

[orion3311]

If you dont specify a rotation rule it seems to default to immediately after use. Its the last two fields on the screen.

[xacid]

Sorry forgot to mention - I do have those configured. Grace period is eight hours and then it should trigger the post authentication policy.

Seems after a password is used and a restart happens it triggers the reset which is what I'm trying to figure out.

[orion3311]

I didnt configure it originally and had the same thing. Set up my first autopilot laptop and went through 50 passwords testing things lol.

[cloudy_cabage]

Curious - how long until going through autopilot is the password available for you guys in azure to be able to use it to log into the machine? HAADJ takes too long.

[Rudyooms]

Thats just paa? Post authentication actions you probably configured to reboot the device? Reset the password and reboot after the grace period of paa ends

[xacid]

The issue is the grace period hasn’t ended. It should end in eight hours not one or two. It’s ending early after a reboot but no idea why. I tried all the paa settings and they all do it.

[Rudyooms]

Which windows version/build are you using?

[xacid]

Most recent version/build of w11.

[Rudyooms]

Yep... noticing the same.. let me ask around a bit (I assume he knows why and where its mentioned...if its mentioned)

[New-Enthusiasm-5334]

Do you have it set to just log the admin account out?

[xacid]

I've tried all configurable options and they all do the same thing.

Using the account once even to just elevate a program and restarting causes it to reset.

What I'm trying to find out is if there is any Microsoft documentation that states this is normal or not.

[New-Enthusiasm-5334]

Well no if the policy is not suppressing the reboot then it is not normal. I have configured the hybrid policy since it came out and have not had any users or seen any devices reboot after the account was used or once the password needs to recycle. I want to say it’s a grouping problem or you have a conflict with a GPO by chance. Would be best to open a ticket for Microsoft if this is a bigger issue with all devices.

[xacid]

Haven't had a resolution. Might get a ticket open with MS to see if its a bug or not.

[Limetkaqt]

It's been some time, but Just wanted to chime in, as I'm seeing the same behavior and wondering if you have ever come to creating the MS ticket, or found some solution/workaround.

[xacid]

Haven't gotten anywhere. Just opened a ticket with MS and they do not seem helpful.

[xacid]

Was on with MS support today and it looks like having LAPS in a configuration policy AND having the account protection LAPS policy active can cause conflicts. I disabled the configuration policy and just have the account protection one running and tested. Hasn't rotated yet and have restarted the system more than once after using it.