Small Town Sysadmin
Free CJIS checklist

Active Directory

Windows LAPS: a unique local admin password on every PC, built into Windows

Stop using the same local administrator password everywhere. Windows LAPS rotates it automatically and stores it in Active Directory, and it's already built into Windows.

In a lot of small domains, every PC has the same local Administrator password, set years ago and never changed. That’s a gift to an attacker: compromise one machine, and that one password opens every other machine on the network.

Windows LAPS (Local Administrator Password Solution) fixes this. It gives each computer its own random local admin password, changes it on a schedule, and stores it in Active Directory where authorized admins can look it up. Best of all, there’s nothing to install on the PCs. It’s built into Windows.

Which computers have it

Windows LAPS arrived with the April 11, 2023 Windows updates. It’s built into:

  • Windows 10 and Windows 11 with the April 2023 update or later
  • Windows Server 2019 and Windows Server 2022 with the April 2023 update or later
  • Windows Server 2025 and later

It’s not available on Windows Server 2016 or older. Those can keep using the older, separately installed “legacy” Microsoft LAPS, which Microsoft has deprecated on newer versions of Windows.

How to set it up in a small domain

Run these from a domain controller or an admin workstation with the RSAT tools, as an admin with the right rights (updating the schema requires Schema Admin).

1. Add the LAPS attributes to Active Directory:

Update-LapsADSchema

2. Let computers in an OU write their own passwords to AD. Replace the OU with the one that holds your workstations:

Set-LapsADComputerSelfPermission -Identity "OU=Workstations,DC=example,DC=local"

3. Turn it on with Group Policy. Create a GPO linked to that OU, then go to Computer Configuration > Administrative Templates > System > LAPS:

  • Configure password backup directory: set to Active Directory
  • Password settings: set length and complexity, and how often it changes (the default is 30 days)

If your domain functional level is Windows Server 2016 or higher, also consider Enable password encryption, so the password is encrypted in AD and only authorized groups can read it.

4. Check that it’s working. On a PC, force a policy check, then look up its password from an admin machine:

Invoke-LapsPolicyProcessing
Get-LapsADPassword -Identity PC-NAME -AsPlainText

Windows LAPS also has its own event log under Applications and Services Logs > Microsoft > Windows > LAPS, which is the first place to look if a machine isn’t reporting in.

Things to watch for

  • Decide who can read the passwords. By default, Domain Admins can. If helpdesk staff need them, grant access deliberately to a specific group.
  • Don’t forget the machines LAPS can’t cover, like older servers or anything not joined to the domain. Give those unique passwords by hand and keep them in a password manager.
  • Test on one OU first. Roll it out to a small group of PCs, confirm passwords appear in AD, then expand.
  • Migrating from legacy LAPS? Microsoft recommends moving to Windows LAPS, and the two can run side by side during the transition. Read Microsoft’s migration guidance before switching over.

Sources

  • Windows LAPS overview (Microsoft Learn): supported versions, the April 11, 2023 release, and the deprecation of legacy Microsoft LAPS
  • LAPS PowerShell module (Microsoft Learn): the Update-LapsADSchema, Set-LapsADComputerSelfPermission, Invoke-LapsPolicyProcessing, and Get-LapsADPassword cmdlets

All articles