How Windows LAPS removes the risk of one shared local administrator password

Windows LAPS generates, stores and rotates a unique local administrator password for each domain device, with authorised retrieval and auditing.

1. Conclusion and scope

A single local administrator password across every endpoint turns one compromised computer into a lateral-movement path. Windows LAPS manages a different password per device and supports automatic rotation, encrypted storage in AD, password history and controlled retrieval.

This issue involves Active Directory, DNS, Group Policy, authentication and domain-controller health. Validate replication, backup and scope before change.

2. Risk signals that deserve priority

• Imaging, scripts or manual builds assign the same Administrator password to every computer.
• A former employee, contractor or malware sample that obtains one password can administer many devices.

3. Pre-change assessment checklist

1. Confirm client and DC updates, directory requirements and coexistence with legacy Microsoft LAPS.
2. Define the managed account, password length, complexity, rotation interval and post-authentication reset behaviour.
3. Design least-privilege groups for reading, decrypting, resetting and auditing passwords.
4. In a pilot OU, validate schema update, computer self-permission, GPO application and event logging.

Get-LapsADPassword -Identity PC-001
Invoke-LapsPolicyProcessing
Reset-LapsPassword
Get-WinEvent -LogName Microsoft-Windows-LAPS/Operational -MaxEvents 30

4. Recommended implementation sequence

1. Update the AD schema where required and grant target computers permission to write their LAPS attributes.
2. Use GPO to configure backup directory, account, password policy and rotation.
3. Grant retrieval rights only to authorised service-desk or administration groups and audit access.
4. Pilot first, then phase endpoints and servers; plan domain-controller DSRM passwords separately.

5. Validation, rollback and common mistakes

• Different devices receive different passwords and rotate them after expiry.
• Unauthorised users cannot retrieve a password, while authorised staff can do so through a controlled request.
• Reset, policy failure and backup events are visible in the LAPS operational log.

Common mistakes

• Leaving a second shared administrator account after LAPS deployment.
• Granting password-read permission to an unnecessarily broad group.
• Ignoring offline devices, long-powered-off computers and recovery scenarios.

Official references

• Microsoft: Windows LAPS overview

Frequently asked questions

Does Windows LAPS require internet access?

No for an on-premises domain deployment; passwords can be backed up to local Active Directory.

Can it manage a custom local administrator account?

Yes, when configured through supported policy and after confirming the account and policy processing on each device.