# Windows 10 or later Configuration Policy - Windows LAPS Policy > Configuration policy for Windows Local Administrator Password Solution (LAPS) Configuration policy for Windows Local Administrator Password Solution (LAPS) ## Settings this baseline controls | Setting | What it does | | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Policy name | Name of the configuration policy. [Learn more](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview) | | Policy description | Description of the configuration policy. [Learn more](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview) | | Backup directory | Directory the managed local administrator password is backed up to (Disabled, Microsoft Entra ID, or Active Directory). [Learn more](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview) | | Password age in days | Maximum age (in days) of the managed local administrator account password. [Learn more](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview) | | Password complexity | Complexity of the managed local administrator account password. [Learn more](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview) | | Password length | Length of the managed local administrator account password. [Learn more](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview) | | Post-authentication actions | Actions taken on expiry of the post-authentication grace period. [Learn more](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview) | | Post-authentication reset delay | Time (in hours) to wait after an authentication before executing the post-authentication actions. [Learn more](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview) | **3 more settings** | Setting | What it does | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Administrator account name | Name of the managed local administrator account (blank uses the built-in administrator). [Learn more](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview) | | Automatic account management enabled | Whether the target local administrator account is automatically managed. [Learn more](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview) | | Group assignments | The list of group assignments for this configuration policy. [Learn more](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview) | [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme. ## Configure it Add this to a tenant's Windows fleet so every device's built-in local administrator password is randomised, rotated and backed up centrally, instead of being set once and never changed. 1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or include it in a scheme you deploy to every tenant enrolling Windows devices ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). Before you do, turn on **Enable Local Administrator Password Solution (LAPS)** in Microsoft Entra ID (**Devices → Device settings**); Intune's policy has no effect on Entra-joined devices until this tenant-wide switch is on. 2. Leave **Backup directory** set to Microsoft Entra ID, so the rotated password is stored in Entra rather than an on-premises Active Directory your MSP may have no path to. 3. Leave **Password length** at `20` and **Password complexity** at its highest level (uppercase, lowercase, numbers and special characters), with the password expiring after `30` days. 4. Leave **Post-authentication actions** set to reset the password and sign the account out `24` hours after the grace period following an authentication. This limits how long a revealed password stays valid. 5. Leave **Administrator account name** and **Automatic account management enabled** unset, so LAPS manages the device's existing built-in administrator account rather than creating or renaming one. 6. Save. Turn on **Auto-remediation** if you want Octiga to recreate this policy in Intune whenever it's changed or removed. > **Licence: Intune:** ## Check it worked This baseline shows **Passing** once the policy exists in Intune with these settings and a Windows device has reported it applied. To check progress, go to **Devices → Manage devices → Configuration** in the Microsoft Intune admin centre, open the profile, and use its device status and per-setting status views. To confirm the password itself is rotating, open **Devices → All devices**, select a device, and look under **Monitor → Local admin password** for the account name, last rotation and next scheduled rotation. End users notice nothing directly: this manages a hidden administrator account, not the one they sign in with. ## Standards this addresses ### NIST - **PR.AC-4** — NIST CSF 2.0 PR.AC-4 - **AC-2** — NIST SP 800-53 AC-2 - **IA-5** — NIST SP 800-53 IA-5 **Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)