Windows LAPS
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 5c1eb68 · +67 −56 lines · also on GitHub
11
---
2
−title: Windows LAPS overview
2
+title: "Windows LAPS Overview: Manage Admin Passwords"
33
description: Get an overview of Windows Local Administrator Password Solution (Windows LAPS), including key scenarios and setup and management options.
44
author: robinharwood
55
ms.author: roharwoo
6
−ms.date: 03/10/2025
7
−ms.topic: overview
6
+ms.date: 09/14/2026
7
+ms.topic: concept-article
8
+ai-usage: ai-assisted
89
# customer intent: As an administrator, I want to become familiar with the Windows Local Administrator Password Solution (Windows LAPS) feature so that I can use it to manage and back up administrator passwords.
910
---
1011
1112
# What is Windows LAPS?
1213
13
−Windows Local Administrator Password Solution (Windows LAPS) is a Windows feature that automatically manages and backs up the password of a local administrator account on your Microsoft Entra-joined or Windows Server Active Directory-joined devices. You also can use Windows LAPS to automatically manage and back up the Directory Services Restore Mode (DSRM) account password on your Windows Server Active Directory domain controllers. An authorized administrator can retrieve the DSRM password and use it.
14
+Windows Local Administrator Password Solution (Windows LAPS) is a Windows feature that automatically manages and backs up the password of a local administrator account on your Microsoft Entra-joined or Windows Server Active Directory-joined devices. You can also use Windows LAPS to manage and back up the Directory Services Restore Mode (DSRM) account password on your Windows Server Active Directory domain controllers.
1415
16
+Local administrator accounts often share the same password across many devices, which bad actors can exploit to move laterally across your environment. Windows LAPS helps you close that gap by regularly rotating each device's local administrator password, storing it securely, and letting authorized administrators retrieve it to sign in to or recover a device.
17
+
18
+This article introduces the platforms that Windows LAPS supports, its key scenarios and benefits, and how it differs from the legacy Microsoft LAPS product, so that you can decide how to use Windows LAPS in your environment.
19
+
1520
## Windows LAPS supported platforms
1621
1722
Windows LAPS is available on the following OS platforms:
⋯ 1 unchanged line
1924
### Windows client
2025
2126
- Windows 11 23H2 and later.
22
−- Other versions of Windows client that have received the April 11, 2023 Update or later, including:
27
+- Other versions of Windows client that received the April 11, 2023 Update or later, including:
2328
- [Windows 11 22H2 - April 11 2023 Update](https://support.microsoft.com/help/5025239) and later.
2429
- [Windows 11 21H2 - April 11 2023 Update](https://support.microsoft.com/help/5025224) and later.
2530
- [Windows 10 - April 11 2023 Update](https://support.microsoft.com/help/5025221) and later.
2631
27
−> [!NOTE]
28
−> The [Automatic Account Management](/windows/client-management/mdm/laps-csp#automaticaccountmanagementenabled) CSP settings require Windows 11 24H2 or later.
32
+Windows 10 reached the end of support on October 14, 2025. Windows LAPS remains available only on Windows 10 devices that continue to receive updates, such as through the Extended Security Updates (ESU) program. For supported Windows 10 servicing and lifecycle dates, see the [Windows lifecycle FAQ](/lifecycle/faq/windows). For new deployments, use Windows 11 or a supported version of Windows Server.
2933
34
+The [Automatic Account Management](/windows/client-management/mdm/laps-csp#automaticaccountmanagementenabled) settings in the Windows LAPS configuration service provider (CSP) require Windows 11, version 24H2 or later, or Windows Server 2025 or later.
35
+
3036
### Windows Server
3137
3238
- Windows Server 2025 and later.
3339
- [Windows Server Annual Channel for Containers, 23H2 and later](https://support.microsoft.com/topic/windows-server-version-23h2-update-history-68c851ff-825a-4dbc-857b-51c5aa0ab248).
34
−- Other versions of Windows Server that have received the April 11, 2023 Update or later, including:
40
+- Other versions of Windows Server that received the April 11, 2023 Update or later, including:
3541
- [Windows Server 2022 - April 11 2023 Update](https://support.microsoft.com/help/5025230) and later.
3642
- [Windows Server 2019 - April 11 2023 Update](https://support.microsoft.com/help/5025229) and later.
3743
38
−All supported editions of these platforms have been updated with Windows LAPS, including long-term servicing channel (LTSC) editions. The introduction of the Windows LAPS feature doesn't modify the standard Microsoft product lifecycle policies.
44
+Windows LAPS is available in all supported editions of these platforms, including long-term servicing channel (LTSC) editions. Introducing the Windows LAPS feature doesn't modify the standard Microsoft product lifecycle policies.
3945
4046
## Windows LAPS and Microsoft Entra ID
4147
⋯ 6 unchanged lines
4854
- Protection against pass-the-hash and lateral-traversal attacks
4955
- Improved security for remote help desk scenarios
5056
- Ability to sign in to and recover devices that are otherwise inaccessible
51
−- A fine-grained security model (access control lists and optional password encryption) for securing passwords that are stored in Windows Server Active Directory
52
−- Support for the Microsoft Entra role-based access control model for securing passwords that are stored in Microsoft Entra ID
57
+- A fine-grained security model (access control lists and optional password encryption) for securing passwords stored in Windows Server Active Directory
58
+- Support for the Microsoft Entra role-based access control model for securing passwords stored in Microsoft Entra ID
5359
54
−## Informational videos
60
+## Windows LAPS informational videos
5561
56
−The following videos offer an informative way to see more about the Windows LAPS feature.
62
+The following videos give you more information about the Windows LAPS feature. Because these videos don't include text content, use the surrounding articles for the authoritative Windows LAPS guidance.
5763
5864
Windows Technical Takeoff presentation (November 2022):
5965
60
−>[!Video https://www.youtube.com/embed/jdEDIXm4JgU]
66
+> [!VIDEO https://www.youtube.com/embed/jdEDIXm4JgU]
6167
6268
Windows Tackling Tech discussion (August 2023):
6369
64
−>[!Video https://www.youtube.com/embed/bcs1gPB4dOQ]
70
+> [!VIDEO https://www.youtube.com/embed/bcs1gPB4dOQ]
6571
6672
## Key Windows LAPS scenarios
6773
⋯ 5 unchanged lines
7379
7480
- Back up DSRM account passwords to Windows Server Active Directory (for Windows Server Active Directory domain controllers)
7581
76
−- Back up local administrator account passwords to Windows Server Active Directory by using legacy Microsoft LAPS
82
+- Back up local administrator account passwords to Windows Server Active Directory by using [legacy Microsoft LAPS emulation mode](laps-scenarios-legacy.md), in which native Windows LAPS honors your existing legacy Microsoft LAPS Group Policy settings during migration
7783
7884
In each scenario, you can apply different policy settings.
7985
⋯ 15 unchanged lines
95101
96102
- [Windows LAPS configuration service provider (CSP)](/windows/client-management/mdm/laps-csp)
97103
- [Windows LAPS Group Policy](laps-management-policy-settings.md#windows-laps-group-policy)
98
−- [Legacy Microsoft LAPS](https://www.microsoft.com/download/details.aspx?id=46899)
104
+- [Legacy Microsoft LAPS emulation mode](laps-scenarios-legacy.md), in which native Windows LAPS reads your existing legacy Microsoft LAPS Group Policy settings
99105
100106
## Manage and monitor Windows LAPS
101107
102
−You also have various options to manage and monitor Windows LAPS.
108
+You have several options to manage and monitor Windows LAPS.
103109
104110
Options for Windows include:
105111
106
−- The Windows Server Active Directory Users and Computers properties dialog.
107
−- A dedicated event log channel.
108
−- A Windows PowerShell module that's specific to Windows LAPS.
112
+- The **Active Directory Users and Computers** properties dialog box. For more information, see [Get started with Windows LAPS and Windows Server Active Directory](laps-scenarios-windows-server-active-directory.md).
113
+- A dedicated event log channel. For more information, see [Windows LAPS troubleshooting guidance](/troubleshoot/windows-server/windows-security/windows-laps-troubleshooting-guidance).
114
+- A Windows PowerShell module that's specific to Windows LAPS. For more information, see the [LAPS PowerShell module reference](/powershell/module/laps).
109115
110
−Entra-based monitoring and reporting solutions are available when you back up passwords to Microsoft Entra ID.
116
+When you back up passwords to Microsoft Entra ID, you get Microsoft Entra ID-based monitoring and reporting solutions.
111117
112118
## Deprecation of the legacy Microsoft LAPS product
113119
114120
> [!IMPORTANT]
115
−> The [legacy Microsoft LAPS product](https://www.microsoft.com/download/details.aspx?id=46899) is deprecated as of Windows 11 23H2 and later. Installation of the legacy Microsoft LAPS Microsoft Installer (MSI) package is blocked on newer OS versions, and Microsoft no longer considers code changes for the legacy Microsoft LAPS product.
121
+> The [legacy Microsoft LAPS product](https://www.microsoft.com/download/details.aspx?id=46899) is deprecated as of Windows 11 23H2 and later. Newer OS versions block installation of the legacy Microsoft LAPS Microsoft Installer (MSI) package. Microsoft no longer considers code changes for the legacy Microsoft LAPS product.
116122
>
117
−> Use Windows LAPS for managing local administrator account passwords. Windows LAPS is available on Windows Server 2019 and later, and on supported Windows 10 and Windows 11 clients.
123
+> Use Windows LAPS to manage local administrator account passwords. Windows LAPS is available on Windows Server 2019 and later, and on supported Windows 10 and Windows 11 clients.
118124
>
119
−> Microsoft will continue to support the legacy Microsoft LAPS product on older versions of Windows (earlier than Windows 11 23H2) on which it was previously supported. That support will end upon the normal end of support for those OS versions.
125
+> Microsoft will continue to support the legacy Microsoft LAPS product on the older versions of Windows (earlier than Windows 11 23H2) that previously supported it. That support ends at the normal end of support for those OS versions.
120126
121127
## Windows LAPS vs. legacy Microsoft LAPS
122128
123
−Windows LAPS inherits many design concepts from legacy Microsoft LAPS. If you're familiar with legacy Microsoft LAPS, many Windows LAPS features are familiar. A key difference is that Windows LAPS is an entirely separate implementation that's native to Windows. Windows LAPS also adds many features that aren't available in legacy Microsoft LAPS. You can use Windows LAPS to back up passwords to Microsoft Entra ID, encrypt passwords in Windows Server Active Directory, and store your password history.
129
+Windows LAPS inherits many design concepts from legacy Microsoft LAPS. If you're familiar with legacy Microsoft LAPS, you recognize many Windows LAPS features. A key difference is that Windows LAPS is an entirely separate implementation that's native to Windows. Windows LAPS also adds many features that aren't available in legacy Microsoft LAPS. You can use Windows LAPS to back up passwords to Microsoft Entra ID, encrypt passwords in Windows Server Active Directory, and store your password history.
124130
125
−> [!IMPORTANT]
126
−> Windows LAPS doesn't require you to install legacy Microsoft LAPS. You can fully deploy and use all Windows LAPS features without installing or referring to legacy Microsoft LAPS. But to help migrate an existing legacy Microsoft LAPS deployment, Windows LAPS offers [legacy Microsoft LAPS emulation mode](laps-scenarios-legacy.md).
131
+Windows LAPS doesn't require you to install legacy Microsoft LAPS. You can fully deploy and use all Windows LAPS features without installing or referring to legacy Microsoft LAPS. To help migrate an existing legacy Microsoft LAPS deployment, Windows LAPS offers [legacy Microsoft LAPS emulation mode](laps-scenarios-legacy.md). Remember that the legacy Microsoft LAPS product is deprecated on newer Microsoft OS versions. For more information, see [Deprecation of the legacy Microsoft LAPS product](#deprecation-of-the-legacy-microsoft-laps-product).
127132
128
−> [!IMPORTANT]
129
−> The legacy Microsoft LAPS product is deprecated on newer Microsoft OS versions. For more information, see [Deprecation of the legacy Microsoft LAPS product](laps-overview.md#deprecation-of-the-legacy-microsoft-laps-product).
133
+## From legacy Microsoft LAPS to native Windows LAPS
130134
131
−## Support statement
135
+Because the legacy Microsoft LAPS product is deprecated and newer Windows versions block its installer, native Windows LAPS is the supported way to manage local administrator passwords. Native Windows LAPS requires no separate download or installation. It's built into supported versions of Windows and Windows Server, so you don't need to install legacy Microsoft LAPS to adopt it.
132136
133
−Microsoft released the legacy Microsoft LAPS product in calendar year 2016 on the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=46899). Windows LAPS shipped as part of Windows Updates released on April 11, 2023, for the platforms listed in [Windows LAPS and Microsoft Entra ID](laps-overview.md#windows-laps-and-microsoft-entra-id).
137
+To plan and complete the move on devices that currently run legacy Microsoft LAPS, see [Migrate to Windows LAPS from legacy LAPS](laps-scenarios-migration.md). That article is the authoritative source for the migration prerequisites, the available migration options, how to validate that native Windows LAPS manages your accounts successfully, and how to remove the legacy Microsoft LAPS software after the transition.
134138
135
−Microsoft and its support delivery organization offer assisted support for both Microsoft LAPS and Windows LAPS, including interoperability between the two products.
139
+## Legacy Microsoft LAPS emulation mode
136140
137
−> [!IMPORTANT]
138
−> The legacy Microsoft LAPS product is deprecated on newer Microsoft OS versions. For more information, see [Deprecation of the legacy Microsoft LAPS product](laps-overview.md#deprecation-of-the-legacy-microsoft-laps-product).
141
+If you can't move directly to native Windows LAPS, you can run Windows LAPS in *legacy Microsoft LAPS emulation mode* as a transitional option. In this mode, Windows LAPS honors your existing legacy Microsoft LAPS Group Policy settings while you complete the migration.
139142
140
−We strongly recommend that you begin planning now to migrate your Windows LAPS-capable systems from using legacy Microsoft LAPS over to the Windows LAPS feature. Windows LAPS offers many new security features and improved product servicing.
143
+Emulation mode has two critical prerequisites:
141144
142
−Questions about limitations and interoperability concerns between third-party local account password management tools and Windows LAPS should be directed to the third-party application developer, not Microsoft.
145
+- Don't install the legacy Microsoft LAPS Group Policy client-side extension (CSE) on the managed device. If the legacy CSE is present, Windows LAPS defers to it and disables emulation mode to avoid conflicts.
146
+- Native Windows LAPS policy settings take precedence. If you configure a device with both native Windows LAPS policy settings and legacy Microsoft LAPS policy settings, Windows LAPS applies the native settings and ignores the emulated legacy settings.
143147
144
−## Licensing requirements
148
+Emulation mode has security limitations. Like legacy Microsoft LAPS, it stores passwords in Windows Server Active Directory only in clear-text form, so it can't use the password encryption or password history features of native Windows LAPS. Treat emulation mode as a temporary step, and plan to migrate to native Windows LAPS to take advantage of its security features. For more information, see [Get started with Windows LAPS in legacy Microsoft LAPS emulation mode](laps-scenarios-legacy.md).
145149
146
−The Windows LAPS feature itself is available for free in all supported Windows platforms.
150
+## Windows LAPS and legacy Microsoft LAPS support statement
147151
152
+Microsoft released the legacy Microsoft LAPS product in 2016 on the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=46899). Windows LAPS shipped as part of Windows Updates released on April 11, 2023, for the platforms listed in [Windows LAPS supported platforms](#windows-laps-supported-platforms).
153
+
154
+Microsoft and its support delivery organization offer assisted support for both legacy Microsoft LAPS and Windows LAPS, including interoperability between the two products. Microsoft deprecated the legacy Microsoft LAPS product on newer Microsoft OS versions. For more information, see [Deprecation of the legacy Microsoft LAPS product](#deprecation-of-the-legacy-microsoft-laps-product).
155
+
156
+We strongly recommend that you begin planning now to migrate your Windows LAPS-capable systems from legacy Microsoft LAPS to the Windows LAPS feature. Windows LAPS offers many new security features and improved product servicing.
157
+
158
+Direct questions about limitations and interoperability concerns between third-party local account password management tools and Windows LAPS to the developer of the third-party application, not Microsoft.
159
+
160
+## Windows LAPS licensing requirements
161
+
162
+The Windows LAPS feature is available at no cost on all supported Windows platforms.
163
+
148164
You can back up passwords to Windows Server Active Directory with no other licensing requirements.
149165
150166
You can back up passwords to Microsoft Entra ID with a Microsoft Entra ID Free or higher license.
151167
152
−Other Entra-related or Intune-related features can have other licensing requirements.
168
+Other Microsoft Entra ID or Microsoft Intune features can have other licensing requirements.
153169
154
−## Submit feedback
170
+## Submit feedback about Windows LAPS
155171
156
−Want to send us feedback? Feel free to submit document-specific questions via the feedback links at the bottom of this page.
172
+Want to send us feedback? To submit document-specific questions, use the feedback links at the bottom of this page.
157173
158
−You can also submit feedback and other requests via the [Windows LAPS feedback](https://aka.ms/WindowsLAPSFeedback) Tech Community page.
174
+You can also submit feedback and other requests on the [Windows LAPS feedback](https://aka.ms/WindowsLAPSFeedback) Tech Community page.
159175
160
−If your feedback is specific to the Microsoft Entra ID-related or Intune-related LAPS functionality, you can submit feedback via the [Microsoft Entra feedback forum](https://feedback.azure.com/d365community/forum/22920db1-ad25-ec11-b6e6-000d3a4f0789).
176
+If your feedback is specific to the Microsoft Entra ID-related or Intune-related LAPS functionality, submit feedback through the [Microsoft Entra feedback forum](https://feedback.azure.com/d365community/forum/22920db1-ad25-ec11-b6e6-000d3a4f0789).
161177
162178
If you aren't sure where your feedback should go, submit it by using any of these options.
163179
164
−## See also
165
−
166
−- [Introducing Windows Local Administrator Password Solution with Microsoft Entra ID](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/introducing-windows-local-administrator-password-solution-with/ba-p/1942487)
167
−- [Windows Local Administrator Password Solution in Microsoft Entra ID](https://aka.ms/cloudlaps)
168
−- [Windows Local Administrator Password Solution with Microsoft Entra ID now generally available!](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/windows-local-administrator-password-solution-with-microsoft/ba-p/3911999)
169
−- [Microsoft Intune support for Windows LAPS](/mem/intune/protect/windows-laps-overview)
170
−- [LAPS CSP](/windows/client-management/mdm/laps-csp)
171
−- [Windows LAPS troubleshooting guidance](/troubleshoot/windows-server/windows-security/windows-laps-troubleshooting-guidance)
172
−- [LAPS PowerShell module reference](/powershell/module/laps)
173
−- [Legacy Microsoft LAPS](https://www.microsoft.com/download/details.aspx?id=46899)
174
−
175
−## Next steps
180
+## Related content
176181
177182
- [Key concepts in Windows LAPS](laps-concepts-overview.md)
178183
- [Get started with Windows LAPS and Windows Server Active Directory](laps-scenarios-windows-server-active-directory.md)
179184
- [Get started with Windows LAPS and Microsoft Entra ID](laps-scenarios-azure-active-directory.md)
180185
- [Get started with Windows LAPS in legacy Microsoft LAPS emulation mode](laps-scenarios-legacy.md)
186
+- [Migrate to Windows LAPS from legacy LAPS](laps-scenarios-migration.md)
187
+- [Windows LAPS CSP](/windows/client-management/mdm/laps-csp)
188
+- [LAPS PowerShell module reference](/powershell/module/laps)
189
+- [Windows LAPS troubleshooting guidance](/troubleshoot/windows-server/windows-security/windows-laps-troubleshooting-guidance)
190
+- [Microsoft Intune support for Windows LAPS](/mem/intune/protect/windows-laps-overview)
191
+- [Windows Local Administrator Password Solution in Microsoft Entra ID](/azure/active-directory/devices/howto-manage-local-admin-passwords)
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:37 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.