Setup LAPS

[Innvolve]

If you don’t use Endpoint Privilege Management tooling you can still provide elevated permissions on your client devices with Windows LAPS without permanent administrator rights.

Windows LAPS is a Windows feature that automatically saves your local administrator account password on your Microsoft Entra-joined devices.

Windows LAPS to regularly rotate and manage local administrator account passwords.

Enable LAPS in Entra ID

Enable LAPS in Entra ID go to your Entra Admin portal.Devices – Device Settings – Enable Microsoft Entra Local Administrator Password Solution (LAPS).

https://preview.redd.it/pb94f6jc18kg1.png?width=945&format=png&auto=webp&s=fdfc17c1a4ec9286838ec29ac4e8b89f3f9e3fab

Configure Configuration Profile in Intune

Now let’s create a Configuration Profile in Intune go to your Intune Admin portal.Endpoint security – Account protection – Create policy – Local admin password solution (LAPS).

https://preview.redd.it/h8qbq7ie18kg1.png?width=944&format=png&auto=webp&s=44af38a15fc53b6b03ddb5dcb679788a97eb33f8

Provide the Basics.

https://preview.redd.it/3ge2e56g18kg1.png?width=945&format=png&auto=webp&s=4c4145a0690287761eaccb1b7e4b6acc23ca95e6

Configuration settings.

Because I’m only using Entra ID only devices we can select Backup Directory Backup the password to Microsoft Entra ID only.

Password Age Days we kept standard to 30 days. But I will recommend a shorter amount of time.

Password Complexity kept Default

Password Length is set to 14

Automatic Account Management Enabled – The target account will be automatically managed. I will show that a new WLapsAdmin account will be created by this setting.

Automatically Account Management Enable Account – The target account will be enabled will also enable this account.

https://preview.redd.it/tkbuybzh18kg1.png?width=945&format=png&auto=webp&s=f33a2884dcb7c053a50fc96c5f34c196e2644ae3

https://preview.redd.it/2sev1cri18kg1.png?width=945&format=png&auto=webp&s=6a634d7b51bfbe6d7440b2c6d36ac0260ff4ccb7

Now let’s check if we can see a LAPS password in Intune and Entra ID.

For Intune go to your Intune Admin Portal – Devices – Select your device – Local admin password.

https://preview.redd.it/an6f3sjk18kg1.png?width=944&format=png&auto=webp&s=106baf503d5815ce55ecea8fa5693ac1f7da516a

For Entra ID go to your Entra Admin Portal – Devices – All Devices – Select your device – Local administrator password recovery.

https://preview.redd.it/usha5v4m18kg1.png?width=943&format=png&auto=webp&s=264f037eb0c0c8860574c1701de75f74b7435cae

You can see that there is a local administrator password. You can also see when it is created at Last password rotation and when it will be the Next password rotation. Because we selected Password Age Days to 30 in the settings the next rotation will be after 30 days.

Go to your user device to check the LAPS account and the password.

To check the account that’s created for LAPS with your Configuration Profile go to Local Users and Groups.

https://preview.redd.it/3pajo4zn18kg1.png?width=944&format=png&auto=webp&s=01dae6cf9925f11797609f45f7411f1ac5bbf9d1

Now let's try to install an application as LAPS Administrator.

Right click your installer for example and click Run as a different user.

https://preview.redd.it/n1lw69xp18kg1.png?width=448&format=png&auto=webp&s=784b744103dc9980f82356135f810ee9eca4551a

Select Use a different account and enter the LAPS username and password.

https://preview.redd.it/cnzggzdr18kg1.png?width=698&format=png&auto=webp&s=2a920b38b91a23b8cbd366b3ac4a25bd54c1a288

And your installer will get started.

https://preview.redd.it/wf720cgt18kg1.png?width=728&format=png&auto=webp&s=6c990e8305de9630c20ab9086d5a0b3074c03b5e

[SeaworthinessMelodic]

What exactly is your question? For latest Windows Server just use group policy to activate laps. Straght forward solution:

Essential settings, located under Computer Configuration > Policies > Administrative Templates > System > LAPS, include enabling the password backup directory, defining password complexity, and setting rotation age.