Deploying Windows LAPS

Although it has been around for years for on-premises directories, this is a very new addition for Entra-managed devices, largely due to the inclusion of the LAPS client within Windows itself rather than needing an additional MSI and AD (Active Directory) schema update.

Before looking at deploying LAPS, it is first worth understanding what it does and why you may want to use it. LAPS is a system that rotates the local admin password on a machine to add an extra layer of security as it ensures no two machines have the same password; this helps prevent lateral traversal attacks.

With the introduction of Autopilot, Intune, and Entra ID, this was removed as the admin account was disabled by default. There are options available for managing these devices (such as the Cloud Joined Device Local Admin Role or Local User Group Membership), but they both have disadvantages (the role is for all devices and the membership is one policy per device).

Windows LAPS...