Skip to main content
< All Topics
Print

Install and configure LAPS –

Posted
Updated
Bychris_fry

Below is the setup for Windows LAPS, which is built into Windows 10/11, Server 2019, and Server 2022/2025 with the April 2023 cumulative update or later. The older standalone “Microsoft LAPS” (legacy, MSI-based) is deprecated, so new deployments should use Windows LAPS.

1. Check prerequisites

  • Clients and servers need the April 2023 or later cumulative update.
  • Password encryption in AD requires a domain functional level of 2016 or higher.
  • You need Schema Admins rights for the schema extension and Domain Admin or delegated rights on the target OUs.

2. Extend the AD schema

Run this once per forest from a machine with the LAPS PowerShell module, such as a DC:

powershell

Update-LapsADSchema

This adds the msLAPS-* attributes to computer objects.

3. Let computers write their own passwords

Run this for each OU that contains managed computers:

powershell

Set-LapsADComputerSelfPermission -Identity "OU=Workstations,DC=contoso,DC=com"

4. Delegate who can read and reset passwords

Use a dedicated group instead of individual accounts:

powershell

Set-LapsADReadPasswordPermission  -Identity "OU=Workstations,DC=contoso,DC=com" -AllowedPrincipals "CONTOSO\LAPS-Readers"
Set-LapsADResetPasswordPermission -Identity "OU=Workstations,DC=contoso,DC=com" -AllowedPrincipals "CONTOSO\LAPS-Admins"

You can audit the current permissions with Find-LapsADExtendedRights -Identity <OU>.

5. Create the Group Policy

If you use a Central Store, copy LAPS.admx and LAPS.adml from C:\Windows\PolicyDefinitions on an updated machine into \\domain\SYSVOL\domain\Policies\PolicyDefinitions.

Then create a GPO and go to Computer Configuration → Policies → Administrative Templates → System → LAPS. Configure these settings:

  • Configure password backup directory: Enabled, set to Active Directory. This is required because nothing happens without it.
  • Password Settings: Set complexity, length (for example 15–20 characters or more), and age (for example 30 days).
  • Name of administrator account to manage: Set this only if you manage a custom local admin account. Leave it unconfigured to manage the built-in Administrator account, which is found by its well-known SID even if it has been renamed.
  • Enable password encryption: Enabled. This is recommended and requires DFL 2016.
  • Configure authorized password decryptors: Set a group such as CONTOSO\LAPS-Readers. The default is Domain Admins.
  • Post-authentication actions (optional): After the managed account is used, LAPS can reset the password and log off or reboot after a grace period.
  • Enable password backup for DSRM accounts (optional): Apply this in a separate GPO linked to the Domain Controllers OU.

Link the GPO to the target OUs.

6. Apply and test

On a client:

powershell

gpupdate /force
Invoke-LapsPolicyProcessing

Check Event Viewer → Applications and Services Logs → Microsoft → Windows → LAPS → Operational. Event ID 10018 means the password was successfully backed up to AD.

7. Retrieve or rotate passwords

To read a password:

powershell

Get-LapsADPassword -Identity PC01 -AsPlainText

To force rotation at the next policy cycle:

powershell

Set-LapsADPasswordExpirationTime -Identity PC01

To rotate immediately, run Reset-LapsPassword on the client itself. You can also view and expire the password from the LAPS tab on the computer object in Active Directory Users and Computers.

Gotchas

  • If legacy LAPS is still deployed, don’t let both versions manage the same account. Either target a different account during migration, or remove the legacy CSE and GPO once Windows LAPS is working. Windows LAPS can run in “legacy emulation mode,” but a clean cutover is simpler.
  • Encrypted passwords can only be read by the authorized decryptors group, even if someone has read rights on the attribute.
  • Exclude the LAPS-managed account from any other GPO or script that sets local admin passwords. Otherwise they will fight each other.

If you have a hybrid or Entra-joined environment, the backup directory can be set to Microsoft Entra ID instead, typically configured through Intune.