What is LAPS?
LAPS (Local Administrator Password Solution) is a Microsoft feature that manages the password of one local administrator account on each Windows computer. It sets a long random password that differs on every machine, changes it on a schedule, and backs it up to Active Directory or Microsoft Entra ID, where only delegated administrators can read it. The problem it solves is the shared local admin password. Computers deployed from one image all start with the same local Administrator credential, so a password or hash stolen from one of them works on all the rest.
How LAPS works
- A Group Policy or Intune policy tells each device which account to manage, which directory to back up to, and the password length, complexity and maximum age.
- The device generates each new password itself, saves it to its own computer object in the directory and then sets it locally. Rotation happens when the password reaches its age limit, 30 days by default in Windows LAPS, or when an administrator forces a reset.
- Read access is delegated to specific groups, such as workstation support. Ordinary domain users can't see the password.
- Optional post-authentication actions rotate the password after a grace period once someone signs in with the managed account, and can also sign that session out or restart the device.
Two versions exist. Legacy Microsoft LAPS, a separate download released in 2015, kept the password in a plain-text directory attribute protected only by permissions. Windows LAPS, built into supported Windows and Windows Server releases since 2023, adds Entra ID backup, optional encryption of the stored password in Active Directory, password history and backup of the Directory Services Restore Mode password on domain controllers. Microsoft has deprecated the legacy version.
Example: retrieving one machine's password
A laptop has lost its trust relationship with the domain, so domain sign-ins on it fail. A technician looks up that machine's local admin password from a management workstation:
Get-LapsADPassword -Identity LT-0219 -AsPlainText
The output shows the managed account, the current password and when it expires. For devices that back up to Entra ID, the same lookup happens in the Entra or Intune admin center. The password works only on LT-0219, and once the technician signs in with it, a post-authentication action can replace it automatically.
What LAPS does and doesn't stop
LAPS removes the shared secret that lets one compromised workstation unlock many. An attacker who dumps the local administrator hash from one laptop and tries pass-the-hash elsewhere finds it fails on every other machine. LAPS doesn't stop credential theft on the machine already compromised, doesn't manage domain or service accounts, and doesn't help when everyday users are local administrators in their own right. It works alongside other controls: taking users out of the local Administrators group, denying network and Remote Desktop sign-in to local accounts, and keeping the list of people who can read LAPS passwords short. Anyone holding that read right can collect every password in its scope, so the right itself deserves the protection of a privileged role.
LAPS vs. PAM vault vs. gMSA
- LAPS: one local admin account per Windows device, built in and free.
- Privileged access management (PAM) vault: stores and rotates many privileged credentials, with approval, check-out and session recording.
- Group managed service account (gMSA): automatic password management for service accounts that run applications across servers.
LAPS on the CompTIA Security+ exam
LAPS is not on the SY0-801 acronym list. The idea is taught under objective 4.5, with local privileged accounts, and under objective 4.1, as part of hardening Windows endpoints. The classic scenario: workstations cloned from a single image share one local admin password, and a hash stolen from one laptop opens dozens of others. The best answer is unique, automatically rotated local admin passwords, which is what LAPS provides. Distractors include a longer shared password, which is still shared; renaming the Administrator account, which leaves the hash usable; a stricter domain password policy; and account lockout.