What this check looks at
Checks that Windows devices back up a unique, rotating local administrator password to Entra ID with Windows LAPS. Only device names are read, never the passwords.
Every Windows device has a built-in local Administrator account, and many organisations’ devices were built with the same local admin password on every machine, or with a second local admin account whose password the IT supplier knows. Windows LAPS, built into Windows 10 and 11 since the April 2023 updates, gives each device its own random local administrator password, rotates it on a schedule and after use, and backs it up to Microsoft Entra ID where only authorised administrators can read it.
The check looks at Windows devices (not servers) that are Microsoft Entra joined or hybrid joined and have signed in or checked in with Intune in the last 90 days, and compares them with the devices that have a LAPS password backed up in Entra ID. It reads device names only, never passwords. It fails when no device has a backed-up password or more than 10% are missing one, warns when 10% or fewer are missing, and is not applicable when there are no such devices.
A shared local admin password turns one compromised laptop into all of them. An attacker who takes the password hash from one device can use it to sign in as administrator to every other device with the same password, which is how ransomware spreads across a network in hours. It is also a password nobody changes when the technician who knows it leaves.
Why it matters
A local administrator password shared across machines lets an attacker who cracks one laptop sign in to every other. Windows LAPS gives each device its own password, rotates it and keeps it where only authorised admins can read it.
A typical case: a phishing email gives an attacker control of a receptionist’s PC at a 50-person engineering firm. They take the local administrator hash, find it works on all 48 laptops and the file server, and deploy ransomware to every machine overnight. Rebuilding takes the business offline for a week, with lost work, missed deadlines and an insurance claim.
With a unique, rotated password on each device, the same attacker would have been stuck on one PC, and the incident would have been a single rebuild.
CIS Microsoft 365 Foundations Benchmark 5.1.4.5 asks for the Local Administrator Password Solution to be enabled; this check goes further and confirms devices are actually backing up passwords. It supports ISO 27001 A.5.17 and A.8.2, PCI DSS 2.2.2 on default accounts and the NCSC Cyber Assessment Framework’s B2.c on privileged user management, and Cyber Essentials’ secure configuration requirement to replace default and shared administrator passwords.
How to fix it
Where: Intune admin centre → Endpoint security → Account protection
Before you start
- Turn on Windows LAPS in Entra ID, Devices, Device settings first; the Intune policy does nothing without it.
- Decide who may read LAPS passwords (a Cloud Device Administrator or custom role).
Step by step
- Turn on LAPS in Microsoft Entra ID. In the Microsoft Entra admin centre, go to Entra ID > Devices > All devices > Device settings. Set "Enable Microsoft Entra Local Administrator Password Solution (LAPS)" to Yes and select Save. The Intune policy does nothing without this.
- Decide who can read the passwords. Cloud Device Administrator, Intune Administrator and Global Administrator can read LAPS passwords. If the help desk needs them without those roles, create a custom role in Entra ID > Roles & admins with the permission microsoft.directory/deviceLocalCredentials/password/read and assign it to them.
- Create the Intune LAPS policy. In the Intune admin centre, go to Endpoint security > Account protection > Create Policy, choose platform Windows and profile "Local admin password solution (Windows LAPS)". Set Backup Directory to back up the password to Microsoft Entra ID only, Password Age Days to 30, Password Complexity to large letters, small letters, numbers and special characters, Password Length to 14 or more, and Post-authentication actions to reset the password and log off the managed account.
- Choose which account LAPS manages. Leave Administrator Account Name empty to manage the built-in Administrator, or enter the name of your own local admin account if devices use one. The built-in Administrator is disabled by default on Entra-joined devices; on Windows 11 24H2 and later you can let the LAPS profile create and manage a dedicated account instead.
- Assign the policy to all Windows devices. Under Assignments, include All devices (or a group with every Windows device), then Review + create.
- Follow up devices that do not back up. For devices still missing a password after a day or two, check the Windows version supports LAPS (Windows 10 20H2 or later, or Windows 11, with the April 2023 updates), look at the Microsoft-Windows-LAPS/Operational event log on the device, and run Invoke-LapsPolicyProcessing in an elevated PowerShell on it to apply the policy straight away.
- Confirm the change. In the Entra admin centre, Entra ID > Devices > Local administrator password recovery lists devices with a backed-up password; open one and choose Show local administrator password to check it works. The number of devices without a password in the finding’s evidence falls at the next assessment.
What users will notice
None. The local administrator password becomes unique per device and rotates automatically.
How to confirm it worked
Open a device in Entra ID or Intune and check "Local administrator password recovery" shows a backed-up password.
Frameworks and controls
This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.c Privileged user management |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | IM-8 Restrict the exposure of credentials and secrets |
| Zero Trust | Endpoints |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| PCI DSS 4.0.1 | 2.2.2 Vendor default accounts are managed |
| NIST SP 800-171 | 3.5.2 Authenticate users, processes and devices |
| CMMC Level 2 | IA.L2-3.5.2 Authentication |
| ISO 27001:2022 | A.5.17 Authentication informationA.8.2 Privileged access rights |
| CIS M365 | 5.1.4.5 Ensure Local Administrator Password Solution is enabled |
| CIS Controls v8.1 | 5.2 Use unique passwords (IG1)4.7 Manage default accounts on enterprise assets and software (IG1) |
| NIST CSF 2.0 | PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Windows LAPS with Microsoft Entra ID (Microsoft Learn)