Since Windows LAPS is built-in to newer versions of Windows, both your client machines and your management machines do not need any additional software installed.

Once a Windows LAPS policy is applied to a client machine, it will immediately begin managing the local administrator password. When the password expires, the device generates a new, random password that's compliant with the current policy's length and complexity requirements.

Windows LAPS uses a background task that wakes up every hour to process the currently active policy. This task isn't implemented with a Windows Task Scheduler task and isn't configurable.

However, you can also manually start the policy processing cycle by forcing a group policy refresh (gpupdate /force) or by running Invoke-LapsPolicyProcessing (preferred because it's more scoped). 

Viewing and Managing Passwords

You must be a member of the group you designated to read LAPS passwords when you reached out to us. Additionally, if you set up password encryption (see Windows LAPS GPO Settings below), you must be a member of the group designated to decrypt passwords.

• AD Attributes. These will either be stored in plain text or encrypted, depending on policy and the attribute. You must be a member of the forementioned group(s) to read these LAPS attributes.
  • The local admin password is stored in msLAPS-Password or msLAPS-EncryptedPassword.
  • The expiration date is stored in msLAPS-PasswordExpirationTime.
  • If encryption and password history are enabled, earlier passwords are stored in msLAPS-EncryptedPasswordHistory.
• ADUC (Active Directory Users and Computers) can be used to view and manage passwords via the LAPS tab. More information here. This only displays the most recently stored password. In order to query older passwords (assuming you enabled password history), you must use the Get-LapsADPassword PowerShell cmdlet.
• The LAPS PowerShell module gives you the most options for viewing and managing LAPS passwords. Information on the module can be found here. Some helpful commands include:
  • To show the most recently stored password you can use Get-LapsADPassword -Identity <computername> -AsPlainText (link). You can optionally add -IncludeHistory to display past passwords.
  • To update a computer's password expiration time, you can use Set-LapsADPasswordExpirationTime -Identity <computername> (link). If you do not specify a time, it will set the expiration time to the current time, which expires the password immediately. You can optionally add -WhenEffective (Get-Date -Date "MM/DD/YYYY HH:MM:SS") to specify a date.
  • To reset the password from the client machine, you can use Reset-LapsPassword.

Windows LAPS GPO Settings

Windows LAPS settings are available under Computer Configuration\Policies\Administrative Templates\System\LAPS. Settings available:

Configure password backup directory

This must be enabled, otherwise the LAPS password will not be backed up to or retrievable from Active Directory.

As previously mentioned, we do not support management of LAPS passwords in Entra ID (Azure Active Directory) at this time. Please make sure you choose Active Directory.

Password Settings

You can configure the password complexity, length, and age to suit your needs.

Default values

• Complexity: Large letters small letters numbers special characters
• Length: 14 characters
• Age: 30 days

Name of administrator account to manage

If you have decided to manage a custom local admin account, you must specify its name here.

Note: DO NOT configure when you use the built-in admin account, even if you renamed it. That account is auto-detected by well-known SID. DO configure when you use a custom local admin account.

Do not allow password expiration time longer than required by policy

If you do not want to allow setting planning password expiration of admin account for longer time than maximum password age, you can do it by enabling this setting. The default setting is enabled.

Enable password encryption

When you enable setting the managed password is encrypted before being send to Active Directory. The default setting is enabled.

Configure authorized password decryptors

Configure this setting to configure the specific user or group who is authorized to decrypt encrypted passwords. Please note this is a separate setting from the one that the AD team configured for you to authorize a group of users to read your LAPS passwords (although you can designate the same group). The enable password encryption setting must be enabled for this to work. If this setting is disabled or not configured, encrypted passwords will be decryptable by only the Domain Admins group.

You need to specify either a SID in string format or the name of a group or user in "domain\(group or user)" format. The specified user or group must be resolvable by the managed device, otherwise passwords will not be backed up.

Configure size of encrypted password history

In order for this setting to work, password encryption must be enabled and passwords must be backed up to Active Directory. You can configure up to 12 previous passwords to be stored in Active Directory. If disabled or not configured, zero older passwords will be stored in Active Directory.

Post-authentication actions

This policy configures post-authentication actions which will be executed after detecting an authentication by the managed account.

• Grace period: the amount of time (in hours) to wait after authentication to take the specified action. If this setting is set to zero, no post-authentication actions will be taken.
• Actions: You can specify one of several actions to take:
  • Reset admin password
  • Reset admin password and log off of the account
  • Reset admin password and reboot the device.

If the setting is disabled or not configured, the default actions will be to reset the admin password and logoff the managed admin account after 24 hours.