What is Windows LAPS?

Windows Local Administrator Password Solution (Windows LAPS) is a Windows feature that automatically manages and backs up the password of a local administrator account on your Microsoft Entra-joined or Windows Server Active Directory-joined devices. You also can use Windows LAPS to automatically manage and back up the Directory Services Restore Mode (DSRM) account password on your Windows Server Active Directory domain controllers. An authorized administrator can retrieve the DSRM password and use it.

Windows LAPS supported platforms

Windows LAPS is available on the following OS platforms:

• Windows 11 23H2 and later Windows Client releases
• Windows Server 23H2 and later Windows Server releases
• Windows 11 22H2 - April 11 2023 Update and later
• Windows 11 21H2 - April 11 2023 Update and later
• Windows 10 - April 11 2023 Update and later
• Windows Server 2022 - April 11 2023 Update and later
• Windows Server 2019 - April 11 2023 Update and later

All supported editions of these platforms have been updated with Windows LAPS, including long-term servicing channel (LTSC) editions. The introduction of the Windows LAPS feature doesn't modify the standard Microsoft product lifecycle policies.

Windows LAPS and Microsoft Entra ID

Windows LAPS with Microsoft Entra ID and Microsoft Intune support is generally available as of October 23, 2023. For more information, see Windows Local Administrator Password Solution with Microsoft Entra ID now generally available! and Windows Local Administrator Password Solution in Microsoft Entra ID.

Benefits of using Windows LAPS

Use Windows LAPS to regularly rotate and manage local administrator account passwords and get these benefits:

• Protection against pass-the-hash and lateral-traversal attacks
• Improved security for remote help desk scenarios
• Ability to sign in to and recover devices that are otherwise inaccessible
• A fine-grained security model (access control lists and optional password encryption) for securing passwords that are stored in Windows Server Active Directory
• Support for the Microsoft Entra role-based access control model for securing passwords that are stored in Microsoft Entra ID

Informational videos

The following videos offer an informative way to see more about the Windows LAPS feature.

Windows Technical Takeoff presentation (November 2022):

Windows Tackling Tech discussion (August 2023):

Key Windows LAPS scenarios

You can use Windows LAPS for several primary scenarios:

• Back up local administrator account passwords to Microsoft Entra ID (for Microsoft Entra-joined devices)

• Back up local administrator account passwords to Windows Server Active Directory (for Windows Server Active Directory-joined clients and servers)

• Back up DSRM account passwords to Windows Server Active Directory (for Windows Server Active Directory domain controllers)

• Back up local administrator account passwords to Windows Server Active Directory by using legacy Microsoft LAPS

In each scenario, you can apply different policy settings.

Understand device join state restrictions

Whether a device is joined to Microsoft Entra ID or Windows Server Active Directory determines how you can use Windows LAPS.

• Devices that are joined only to Microsoft Entra ID can back up passwords only to Microsoft Entra ID.
• Devices that are joined only to Windows Server Active Directory can back up passwords only to Windows Server Active Directory.
• Devices that are hybrid-joined (joined to both Microsoft Entra ID and Windows Server Active Directory) can back up their passwords either to Microsoft Entra ID or to Windows Server Active Directory.

You can't back up passwords to both Microsoft Entra ID and Windows Server Active Directory.

Windows LAPS doesn't support Microsoft Entra workplace-joined clients.

Set Windows LAPS policy

To set up and manage policy for your Windows LAPS deployment, you have multiple options:

• Windows LAPS configuration service provider (CSP)
• Windows LAPS Group Policy
• Legacy Microsoft LAPS

Manage and monitor Windows LAPS

You also have various options to manage and monitor Windows LAPS.

Options for Windows include:

• The Windows Server Active Directory Users and Computers properties dialog.
• A dedicated event log channel.
• A Windows PowerShell module that's specific to Windows LAPS.

Entra-based monitoring and reporting solutions are available when you back up passwords to Microsoft Entra ID.

Deprecation of the legacy Microsoft LAPS product

Windows LAPS vs. legacy Microsoft LAPS

Windows LAPS inherits many design concepts from legacy Microsoft LAPS. If you're familiar with legacy Microsoft LAPS, many Windows LAPS features are familiar. A key difference is that Windows LAPS is an entirely separate implementation that's native to Windows. Windows LAPS also adds many features that aren't available in legacy Microsoft LAPS. You can use Windows LAPS to back up passwords to Microsoft Entra ID, encrypt passwords in Windows Server Active Directory, and store your password history.

Support statement

Microsoft released the legacy Microsoft LAPS product in calendar year 2016 on the Microsoft Download Center. Windows LAPS shipped as part of Windows Updates released on April 11, 2023, for the platforms listed in Windows LAPS and Microsoft Entra ID.

Microsoft and its support delivery organization offer assisted support for both Microsoft LAPS and Windows LAPS, including interoperability between the two products.

We strongly recommend that you begin planning now to migrate your Windows LAPS-capable systems from using legacy Microsoft LAPS over to the Windows LAPS feature. Windows LAPS offers many new security features and improved product servicing.

Questions about limitations and interoperability concerns between third-party local account password management tools and Windows LAPS should be directed to the third-party application developer, not Microsoft.

Licensing requirements

The Windows LAPS feature itself is available for free in all supported Windows platforms.

You can back up passwords to Windows Server Active Directory with no other licensing requirements.

You can back up passwords to Microsoft Entra ID with a Microsoft Entra ID Free or higher license.

Other Entra-related or Intune-related features can have other licensing requirements.

Submit feedback

Want to send us feedback? Feel free to submit document-specific questions via the feedback links at the bottom of this page.

You can also submit feedback and other requests via the Windows LAPS feedback Tech Community page.

If your feedback is specific to the Microsoft Entra ID-related or Intune-related LAPS functionality, you can submit feedback via the Microsoft Entra feedback forum.

If you aren't sure where your feedback should go, submit it by using any of these options.

See also

• Introducing Windows Local Administrator Password Solution with Microsoft Entra ID
• Windows Local Administrator Password Solution in Microsoft Entra ID
• Windows Local Administrator Password Solution with Microsoft Entra ID now generally available!
• Microsoft Intune support for Windows LAPS
• LAPS CSP
• Windows LAPS troubleshooting guidance
• LAPS PowerShell module reference
• Legacy Microsoft LAPS

Next steps

• Key concepts in Windows LAPS
• Get started with Windows LAPS and Windows Server Active Directory
• Get started with Windows LAPS and Microsoft Entra ID
• Get started with Windows LAPS in legacy Microsoft LAPS emulation mode