How to Deploy Windows LAPS for Local Administrator Password Management
Applies to: Windows Server 2019, 2022 and 2025, subject to installed updates and feature availability.
Windows LAPS rotates and backs up local administrator passwords to AD DS or Microsoft Entra ID, reducing credential reuse.
Security controls should be piloted, monitored and reversible through console access. Visit networkmanager.info for managed Windows VPS services.
Prerequisites
- Patch supported servers and management workstations.
- Choose AD DS or Entra backup.
- Define managed account and rotation policy.
- Delegate password-read rights narrowly.
Procedure
Step 1: Check module
Confirm Windows LAPS cmdlets are available.
Get-Command -Module LAPSStep 2: Extend AD schema
Run once with approved Schema Admin change.
Update-LapsADSchemaStep 3: Grant computer self-permission
Target the managed computer OU.
Set-LapsADComputerSelfPermission -Identity 'OU=Servers,DC=corp,DC=example'Step 4: Delegate readers
Grant only the approved support group using LAPS delegation cmdlets.
Step 5: Configure Group Policy
Set backup directory, password age, length, complexity and post-authentication actions.
Step 6: Trigger processing
Refresh policy and inspect events.
gpupdate /force
Invoke-LapsPolicyProcessingVerification
Review policy, LAPS events and authorized password retrieval.
Get-LapsDiagnostics -OutputFolder C:\Temp\LapsDiagnostics
Get-LapsADPassword -Identity 'SRV-APP01'Rollback and recovery
Disable the GPO and remove delegated extended rights through a controlled directory-permission change. Schema extension itself is not ordinarily rolled back.
Security notes
Retrieving a LAPS password is a sensitive audited action; do not paste it into tickets or chat.
Official references
Explore Netcloud24 Canada.
