Windows LAPS
Also known as: LAPS, Local Administrator Password Solution, Microsoft LAPS
Windows LAPS (Local Administrator Password Solution) is a built-in Windows feature that automatically gives each computer's local administrator account a unique, random password, changes it regularly, and stores it securely in Microsoft Entra ID or Active Directory.
IT staff can look up a password when needed. It stops a common attack where criminals crack one shared local admin password and use it to move across every PC. While LAPS is free and effective, many small businesses still use the same local admin password on every machine.
Windows LAPS, explained at three levels
At home
LAPS is like giving every hotel room its own unique key that changes regularly, instead of using one master key that opens every room.
At work
LAPS stops an attacker who gets into one PC from using the same admin password on all the others.
At home
On a home PC, you can set a strong, unique password for any admin account and use a standard account for everyday work, following the same principle.
At work
Windows LAPS is configured through Intune or Group Policy. Passwords are stored in Entra ID or Active Directory and can be retrieved by authorized admins, with rotation after use.
At home
Many attacks rely on reused passwords. In my opinion, unique passwords matter just as much on devices as on websites.
At work
Enable LAPS on all Windows devices, restrict who can read passwords, enable post-authentication rotation, audit password retrievals, and remove old shared local admin accounts.
Real-world examples
At home
Fatima's brother uses the same admin password on every family computer. She suggested unique passwords for each, the same idea behind LAPS.
At work
Thomas manages a Gatineau accounting firm's 40 PCs. He enabled Windows LAPS through Intune, replacing a single local admin password every technician knew.
How it compares
| feature | Windows LAPS | Shared password |
|---|---|---|
| Local admin passwords | Unique per PC | Same on every PC |
| Rotation | Automatic | Rarely changed |
| Attack spread | Contained | Easy lateral movement |
| Cost | Free, built in | Free but risky |
LAPS replaces one master key with many unique, changing keys.
For analysts
In security assessments, I'd check whether local admin passwords are shared. It's a quick finding with a free, well-supported fix.
History & origin
For years, organizations often set the same local administrator password on every PC. In 2014, Microsoft fixed a flaw where passwords stored through Group Policy Preferences could be easily decrypted, leaving many companies without a safe way to manage local passwords. Microsoft released the original LAPS as a free add-on in 2015. In April 2023, Microsoft built a new version, Windows LAPS, directly into Windows 10, Windows 11, and Windows Server, adding support for cloud-based Entra ID, encrypted password storage, and automatic rotation after use. In my view, Windows LAPS is one of the easiest security wins in a Windows environment.