Skip to main content

140: Windows Cloud LAPS

Implementation Effort: Medium — policy deployment is straightforward, but process changes for admin access, auditing, and password retrieval are important.

User Impact: Low — end users are usually unaffected directly, but support staff workflows change significantly.

Overview​

Windows LAPS helps prevent lateral movement by ensuring local administrator credentials are unique, rotated, and stored securely instead of being shared across devices. In a modern Intune-managed environment, Windows LAPS can be configured so eligible Windows devices automatically manage local administrator passwords and back them up to Microsoft Entra ID or Active Directory, depending on your design. This fits Zero Trust by reducing standing privilege and limiting the blast radius of a compromised local admin secret.

Implementation Guidance​

  • Decide which local administrator account model you will use: the built-in Administrator, a custom managed account, or a carefully justified exception for devices that should not have a managed local admin account at all.
  • Configure Windows LAPS policy through Intune with settings for password complexity, length, rotation cadence, post-authentication actions, and backup target.
  • Restrict who can retrieve or rotate LAPS credentials. Retrieval rights should be tightly scoped, audited, and ideally combined with just-in-time or privileged access approval processes.
  • Pilot on representative Windows device groups and validate backup, password rotation, account behavior, and password retrieval workflows before production rollout.
  • Update service desk procedures so support staff know when to use LAPS, how to record access appropriately, and when escalation is required for sensitive devices.
  • Treat Windows LAPS as a support and break-glass control, not an end-user elevation mechanism. If users need controlled elevation, evaluate a separate privilege-management solution.

Video Walkthrough​

Reference​