Windows LAPS & Local Group Management

Why do local admin accounts matter?

How Windows LAPS works

Sam at Tui Solutions is rolling out LAPS across 500 devices. Here’s the flow:

1. Admin configures LAPS via Intune (endpoint security policy or device configuration profile)
2. LAPS generates a unique, random password for the local admin account on each device
3. Password is stored in Microsoft Entra ID (attached to the device object)
4. Password rotates automatically based on the configured schedule (e.g., every 30 days)
5. Authorised admins can view the current password in the Intune admin center or Entra admin center
6. After use, the password can be manually rotated immediately for security

Configuration options

Setting	Options	Sam’s Choice
Backup directory	Entra ID (cloud) or on-prem AD	Entra ID (cloud-native)
Password age	1-365 days	30 days
Administrator account name	Default (built-in Administrator) or custom	Default
Password complexity	Letters + numbers, letters + numbers + symbols, etc.	Large letters + small letters + numbers + special characters
Password length	8-64 characters	14 characters
Post-authentication actions	Reset password, reset password + logoff, reset password + reboot	Reset password + logoff

💡 Exam tip: where are LAPS passwords stored?

The exam tests this: LAPS passwords are stored as a property of the device object in Microsoft Entra ID (for cloud-managed devices) or as a confidential attribute on the computer object in on-premises Active Directory.

For Entra ID-backed LAPS:

• View passwords in Intune admin center → Devices → select device → Local admin password
• View passwords in Entra admin center → Devices → select device → Local administrator password recovery
• Requires the Cloud Device Administrator or Intune Administrator role

The password is never stored in plain text on the device itself. The device encrypts it before sending it to Entra ID.

LAPS vs Legacy LAPS

Feature	Windows LAPS (built-in)	Legacy LAPS (separate download)
Installation	Built into Windows 10/11 (April 2023 update+)	Separate MSI download + GPO extension
Password storage	Entra ID or on-prem AD	On-prem AD only
Management	Intune or GPO	GPO only
Encryption	Password encrypted in transit and at rest	Password stored as clear text in AD (older versions)
Cloud support	Yes (Entra ID)	No
Password history	Yes (viewable in Entra/Intune)	No
Post-auth actions	Automatic password rotation after use	Manual rotation only

Key exam concept: Windows LAPS (the built-in version) replaces Legacy LAPS. For cloud-managed devices, passwords back up to Entra ID. For on-prem devices, they back up to AD. The exam focuses on the built-in version with Entra ID backup.

Managing local group membership with Intune

Beyond LAPS, Intune can control who belongs to local groups on Windows devices. This is critical because the local Administrators group gives full control of the device.

Why it matters

By default, the user who Entra-joins a device is added to the local Administrators group. In many organisations, standard users shouldn’t have local admin rights (least privilege principle). Intune’s Account Protection or Device Configuration policies let you:

• Add specific Entra users or groups to local groups
• Remove users from local groups
• Replace the entire local group membership

Configuration methods

Method	Where	How
Account Protection policy	Intune → Endpoint security → Account protection	Create a “Local user group membership” policy
Device configuration profile	Intune → Devices → Configuration → Settings catalog	Search for “Local Policies Security Options”
Custom OMA-URI	Intune → Devices → Configuration → Custom profile	Use the Policy CSP LocalUsersAndGroups

Common scenarios

Scenario	Configuration
Remove all non-admin users from local Administrators group	Replace membership: add only IT admin group
Add helpdesk team to local Administrators on all devices	Add Entra group “Helpdesk” to local Administrators
Standard users should not be local admins	Remove user from local Administrators; add to local Users
Specific group of developers need local admin on their dev machines	Create a targeted policy: add “Developers” Entra group to local Administrators, target only dev device group

ℹ️ Deep dive: local group management + EPM

Managing local groups and Endpoint Privilege Management (EPM) work together:

• Local group management removes users from the Administrators group → they’re now standard users
• EPM (covered in Module 14) lets those standard users elevate specific apps when needed — without giving them permanent admin rights

This is the Zero Trust approach to local admin: remove standing admin access, then provide just-in-time elevation for specific tasks. Chen Wei at Meridian Bank uses both: standard users everywhere, EPM for approved apps that need admin rights.

🎬 Video walkthrough

🎬 Video coming soon

Windows LAPS & Local Group Management — MD-102 Module 7

Windows LAPS & Local Group Management — MD-102 Module 7

~11 min

Flashcards

Question

What is Windows LAPS and why is it important?

Click or press Enter to reveal answer

Answer

Windows LAPS automatically generates unique, random passwords for the local admin account on each device, storing them securely in Entra ID or on-prem AD. It prevents lateral movement attacks caused by shared local admin passwords across multiple devices.

Click to flip back

💡 Show hint

Question

Where are Windows LAPS passwords stored for cloud-managed devices?

Click or press Enter to reveal answer

Answer

In Microsoft Entra ID, as a property of the device object. Authorised admins can view them in the Intune admin center (Devices → select device → Local admin password) or Entra admin center.

Click to flip back

Question

How does Intune manage local group membership on Windows devices?

Click or press Enter to reveal answer

Answer

Through Account Protection policies (endpoint security) or device configuration profiles. Admins can add, remove, or replace members of local groups like Administrators. This lets you remove standard users from the local Administrators group and enforce least privilege.

Click to flip back

Question

What's the difference between Windows LAPS and Legacy LAPS?

Click or press Enter to reveal answer

Answer

Windows LAPS is built into Windows 10/11, supports Entra ID password backup, Intune management, and password encryption. Legacy LAPS requires a separate download, only backs up to on-prem AD, and uses GPO. The built-in version replaces Legacy LAPS.

Click to flip back

Knowledge Check

Knowledge Check

Sam discovers that all 500 devices at Tui Solutions use the same local admin password: 'TuiAdmin2024!'. An attacker who compromises one device could access all of them. What's the best solution?

AChange the password to something stronger on all devicesBDisable the local admin account on all devicesCDeploy Windows LAPS to generate unique passwords per device and store them in Entra IDDRename the local admin account to something non-obvious

Check Answer

Knowledge Check

Chen Wei wants standard users at Meridian Bank to NOT have local admin rights on their devices. Currently, users who Entra-join their devices are automatically added to the local Administrators group. How should Chen Wei fix this?

AUse an Intune Account Protection policy to replace local Administrators group membership with only the IT admin groupBDon't let users Entra-join their own devicesCAsk each user to remove themselves from the local Administrators groupDCreate a compliance policy that checks for local admin membership

Check Answer

---

Next up: Windows Autopilot: Choose Your Path — understanding the three Autopilot deployment modes and when to use each one.