How to setup Windows Local Administrator Password Solution – LAPS

The end user perspective

What is Windows LAPS?

Windows Local Administrator Password Solution (LAPS) helps manage and back up the password for the local administrator account on Windows desktops or servers. This feature is built into Windows and works with devices joined to either Microsoft Entra ID (Azure AD) or Windows Server Active Directory.

This is a Microsoft feature for the Windows platform that can manage the local administrator password. The Windows devices need to be joined to either Microsoft Entra ID (Azure AD) or Windows Server Active Directory. Windows LAPS can be used in Directory Services Restore Mode (DSRM) for Active Directory but will not be described here.

Microsoft introduces features throughout the life span of the various Windows platforms. Some new features may only be available or operate with a minimum OS platform update version. Windows LAPS will only function on the Windows 10 or 11 desktop if the OS is running the XXH2 versions (for Windows 10 20H2 or later, Windows 11 21H2 or later) and using the 11 April 2023 update or later. Similarly for Windows Server 2019 and 2022 with 11 April 2023 update.

Lets' focus on managing the local admin account and password on Windows desktop devices joined to Microsoft Entra ID (Azure AD).

Where a Windows desktop is enrolled to determines where the local administrator password can be saved to. If the device is joined to Microsoft Entra ID (Azure AD) only then the password can only be save to Microsoft Entra ID. Similarly, for devices joined to Windows Server Active Directory only. However for hybrid-joined devices (joined to Microsoft Entra ID and Windows Server Active Directory) the local administrator password can be saved to Microsoft Entra ID or Windows Server Active Directory but not both.

Note: Windows LAPS is a different product to Microsoft LAPS. Many of the features in Windows LAPS are similar to the older Microsoft LAPS, however, Windows LAPS is native to Windows and does not require the installation of any software, however the minimum licencing requirements for Windows LAPS are Microsoft Intune Plan 1 and Microsoft Entra ID free.

In order to use Windows LAPS in Microsoft Entra ID, the feature needs to be enabled.

The Enable Local Administrator Password Solution (LAPS) setting can be found in the Device settings section of Microsoft Entra ID admin centre.

Once this has been completed, create a Local Administrator Password Solution (LAPS) policy in the Account protection section of Microsoft Intune admin centre.

Settings to consider in this policy are where to save/backup the password (as mentioned above), password age, length and complexity. The Administrator Account Name setting allows for specifying the local administrator name. If set to Configured and the administrator account named, the local account must exist and be enabled on the workstation as this policy will not perform either action. If the setting is Not Configured, the policy will use the default built-in administrator account even if it has been renamed. For Autopilot built workstations, the local administrator account will default to being disabled. Post workstation build, this account will need to be manually (scripted or other means) enabled as the policy will not perform this action. Ensure that all relevant windows devices are included in the Assignments for this policy. The status of the LAPS deployment for any device that has a LAPS policy, can be viewed in the Device actions status section of the Overview pane for that particular device in Microsoft Intune admin centre.

Once Windows LAPS is functioning it will manage the rotation of the password for the local administrator account. This is useful for help desk scenarios where the local administrator password may be seen or provided to the workstation user for some tasks. It protects against pass-the-hash and lateral-traversal attacks. It also has the ability to sign in to and recover windows devices that may have become inaccessible.

The local administrator password can be extracted from the Local admin password pane for the device in the Microsoft Intune admin centre.

Key Points:

• Compatibility: Windows LAPS works on Windows 10 (20H2 or later) and Windows 11 (21H2 or later) with the April 11, 2023 update. It also works on Windows Server 2019 and 2022 with the same update.
• Password Management: It manages the local admin password, ensuring it is regularly updated and secure.
• Where Passwords are Saved: If a device is joined to Microsoft Entra ID, the password is saved there. For devices joined to Windows Server Active Directory, the password is saved there. For hybrid-joined devices, the password can be saved to either but not both.
• Licensing Requirements: You need Microsoft Intune Plan 1 and Microsoft Entra ID free to use Windows LAPS.
• Setup: Enable the feature in the Microsoft Entra ID admin center and create a policy in the Microsoft Intune admin center. This policy will define where to save the password, its age, length, and complexity.

Benefits:

• Security: Regularly rotates the local admin password to prevent unauthorized access.
• Help Desk Support: Allows support engineers to provide temporary admin access to users when needed, without compromising security.
• Recovery: Helps in recovering devices that may have become inaccessible.

The local admin password can be retrieved from the Microsoft Intune admin center when needed.

Windows LAPS offers several useful features beyond just managing local administrator passwords:

1. Automatic Password Rotation: It regularly changes the local admin password to enhance security.
2. Password Encryption: Ensures that stored passwords are encrypted, adding an extra layer of protection.
3. Password History: Keeps a history of previous passwords, which can be useful for auditing and compliance.
4. Directory Services Restore Mode (DSRM) Backups: Helps secure domain controllers by managing DSRM account passwords.
5. Protection Against Attacks: Guards against pass-the-hash and lateral-traversal attacks, which are common methods used by attackers to move laterally within a network.
6. Enhanced Security for Help Desk Scenarios: Allows support engineers to provide temporary admin access without compromising long-term security
7. Recovery Capabilities: Enables signing in to and recovering devices that might otherwise be inaccessible.
8. Integration with Microsoft Entra ID and Intune: Supports cloud-based management and retrieval of passwords through Microsoft Entra ID (formerly Azure AD) and Intune.
9. Fine-Grained Security Model: Uses access control lists and optional password encryption to secure passwords stored in Windows Server Active Directory.
10. Azure Role-Based Access Control (RBAC): Provides detailed control over who can retrieve and manage passwords.

These features make Windows LAPS a robust solution for managing local administrator passwords securely and efficiently.

Can you explain the fine-grained security model?

The fine-grained security model in Windows LAPS is designed to provide detailed control over who can access and manage local administrator passwords. Here’s how it works:

Access Control Lists (ACLs)

• Granular Permissions: ACLs allow administrators to specify exactly who can read or reset the local administrator passwords. This means you can grant access to specific users or groups, ensuring that only authorized personnel can retrieve or manage these passwords.
• Role-Based Access Control (RBAC): Integrates with Azure RBAC, allowing you to use predefined roles or create custom roles to manage permissions. This helps in aligning password management with your organization’s security policies.

Password Encryption

• Secure Storage: Passwords are stored securely in either Microsoft Entra ID (Azure AD) or Windows Server Active Directory. They are encrypted to prevent unauthorized access.
• Encryption Standards: Uses strong encryption standards to ensure that passwords are protected both at rest and in transit.

Audit and Compliance

• Logging and Monitoring: All actions related to password retrieval and management are logged. This includes who accessed the password, when it was accessed, and any changes made. These logs can be reviewed for auditing and compliance purposes.
• Password History: Maintains a history of previous passwords, which can be useful for tracking changes and ensuring compliance with security policies.

Policy Configuration

• Customizable Policies: Administrators can configure policies to define password characteristics such as age, length, and complexity. This ensures that passwords meet the organization’s security requirements.
• Assignment and Scope: Policies can be assigned to specific devices or groups of devices, allowing for tailored security settings based on different needs within the organization.

Integration with Existing Infrastructure

• Hybrid Environments: Supports hybrid environments where devices are joined to both Microsoft Entra ID and Windows Server Active Directory. This flexibility allows organizations to manage passwords across different types of deployments.
• Seamless Management: Integrates with Microsoft Intune and the Microsoft Entra ID admin center, providing a centralized platform for managing and retrieving passwords.

By using these features, Windows LAPS ensures that local administrator passwords are managed securely and efficiently, reducing the risk of unauthorized access and enhancing overall security.

Does this help clarify the fine-grained security model?