Windows 10 or later Configuration Policy - Windows LAPS Policy
Configuration policy for Windows Local Administrator Password Solution (LAPS)
Settings this baseline controls
| Setting | What it does |
|---|---|
| Policy name | Name of the configuration policy. Learn more |
| Policy description | Description of the configuration policy. Learn more |
| Backup directory | Directory the managed local administrator password is backed up to (Disabled, Microsoft Entra ID, or Active Directory). Learn more |
| Password age in days | Maximum age (in days) of the managed local administrator account password. Learn more |
| Password complexity | Complexity of the managed local administrator account password. Learn more |
| Password length | Length of the managed local administrator account password. Learn more |
| Post-authentication actions | Actions taken on expiry of the post-authentication grace period. Learn more |
| Post-authentication reset delay | Time (in hours) to wait after an authentication before executing the post-authentication actions. Learn more |
3 more settings
| Setting | What it does |
|---|---|
| Administrator account name | Name of the managed local administrator account (blank uses the built-in administrator). Learn more |
| Automatic account management enabled | Whether the target local administrator account is automatically managed. Learn more |
| Group assignments | The list of group assignments for this configuration policy. Learn more |
Configure it
Add this to a tenant’s Windows fleet so every device’s built-in local administrator password is randomised, rotated and backed up centrally, instead of being set once and never changed.
-
Add the baseline to the tenant directly (Adding a baseline), or include it in a scheme you deploy to every tenant enrolling Windows devices (Deploying a scheme). Before you do, turn on Enable Local Administrator Password Solution (LAPS) in Microsoft Entra ID (Devices → Device settings); Intune’s policy has no effect on Entra-joined devices until this tenant-wide switch is on.
-
Leave Backup directory set to Microsoft Entra ID, so the rotated password is stored in Entra rather than an on-premises Active Directory your MSP may have no path to.
-
Leave Password length at
20and Password complexity at its highest level (uppercase, lowercase, numbers and special characters), with the password expiring after30days. -
Leave Post-authentication actions set to reset the password and sign the account out
24hours after the grace period following an authentication. This limits how long a revealed password stays valid. -
Leave Administrator account name and Automatic account management enabled unset, so LAPS manages the device’s existing built-in administrator account rather than creating or renaming one.
-
Save. Turn on Auto-remediation if you want Octiga to recreate this policy in Intune whenever it’s changed or removed.
Check it worked
This baseline shows Passing once the policy exists in Intune with these settings and a Windows device has reported it applied. To check progress, go to Devices → Manage devices → Configuration in the Microsoft Intune admin centre, open the profile, and use its device status and per-setting status views. To confirm the password itself is rotating, open Devices → All devices, select a device, and look under Monitor → Local admin password for the account name, last rotation and next scheduled rotation. End users notice nothing directly: this manages a hidden administrator account, not the one they sign in with.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.