Windows LAPS
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit abf08e5 · +35 −34 lines · also on GitHub
11
---
22
title: Windows LAPS overview
3
−description: Get an overview of Windows Local Administrator Password Solution (Windows LAPS), including key scenarios and setup and management options.
3
+description: Get an overview of Windows local administrator password solution (Windows LAPS), including key scenarios and setup and management options.
44
author: jay98014
55
ms.author: justinha
6
−ms.date: 09/06/2023
6
+ms.date: 03/10/2025
77
ms.topic: overview
8
+# customer intent: As an administrator, I want to become familiar with the Windows local administrator password solution (Windows LAPS) feature so that I can use it to manage and back up administrator passwords.
89
---
910
1011
# What is Windows LAPS?
1112
12
−Windows Local Administrator Password Solution (Windows LAPS) is a Windows feature that automatically manages and backs up the password of a local administrator account on your Microsoft Entra-joined or Windows Server Active Directory-joined devices. You also can use Windows LAPS to automatically manage and back up the Directory Services Restore Mode (DSRM) account password on your Windows Server Active Directory domain controllers. An authorized administrator can retrieve the DSRM password and use it.
13
+Windows local administrator password solution (Windows LAPS) is a Windows feature that automatically manages and backs up the password of a local administrator account on your Microsoft Entra-joined or Windows Server Active Directory-joined devices. You also can use Windows LAPS to automatically manage and back up the directory services restore mode (DSRM) account password on your Windows Server Active Directory domain controllers. An authorized administrator can retrieve the DSRM password and use it.
1314
1415
## Windows LAPS supported platforms
1516
1617
Windows LAPS is available on the following OS platforms:
1718
18
−- Windows 11 23H2 (and later Windows Client releases)
19
−- Windows Server 23H2 (and later Windows Server releases)
20
−- [Windows 11 22H2 - April 11 2023 Update](https://support.microsoft.com/help/5025239) (and later)
21
−- [Windows 11 21H2 - April 11 2023 Update](https://support.microsoft.com/help/5025224) (and later)
22
−- [Windows 10 - April 11 2023 Update](https://support.microsoft.com/help/5025221) (and later)
23
−- [Windows Server 2022 - April 11 2023 Update](https://support.microsoft.com/help/5025230) (and later)
24
−- [Windows Server 2019 - April 11 2023 Update](https://support.microsoft.com/help/5025229) (and later)
19
+- [Windows 11 23H2](https://support.microsoft.com/topic/windows-11-version-23h2-update-history-59875222-b990-4bd9-932f-91a5954de434) and later Windows Client releases
20
+- [Windows Server 23H2](https://support.microsoft.com/topic/windows-server-version-23h2-update-history-68c851ff-825a-4dbc-857b-51c5aa0ab248) and later Windows Server releases
21
+- [Windows 11 22H2 - April 11 2023 Update](https://support.microsoft.com/help/5025239) and later
22
+- [Windows 11 21H2 - April 11 2023 Update](https://support.microsoft.com/help/5025224) and later
23
+- [Windows 10 - April 11 2023 Update](https://support.microsoft.com/help/5025221) and later
24
+- [Windows Server 2022 - April 11 2023 Update](https://support.microsoft.com/help/5025230) and later
25
+- [Windows Server 2019 - April 11 2023 Update](https://support.microsoft.com/help/5025229) and later
2526
2627
All supported editions of these platforms have been updated with Windows LAPS, including long-term servicing channel (LTSC) editions. The introduction of the Windows LAPS feature doesn't modify the standard Microsoft product lifecycle policies.
2728
2829
## Windows LAPS and Microsoft Entra ID
2930
30
−Windows LAPS with Microsoft Entra ID and Microsoft Intune support is generally available as of October 23 2023. For more information, see [Windows Local Administrator Password Solution with Microsoft Entra ID now Generally Available!](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/windows-local-administrator-password-solution-with-microsoft/ba-p/3911999), and [Windows Local Administrator Password Solution in Microsoft Entra ID](/azure/active-directory/devices/howto-manage-local-admin-passwords).
31
+Windows LAPS with Microsoft Entra ID and Microsoft Intune support is generally available as of October 23, 2023. For more information, see [Windows Local Administrator Password Solution with Microsoft Entra ID now Generally Available!](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/windows-local-administrator-password-solution-with-microsoft/ba-p/3911999) and [Windows Local Administrator Password Solution in Microsoft Entra ID](/azure/active-directory/devices/howto-manage-local-admin-passwords).
3132
3233
## Benefits of using Windows LAPS
3334
⋯ 3 unchanged lines
3738
- Improved security for remote help desk scenarios
3839
- Ability to sign in to and recover devices that are otherwise inaccessible
3940
- A fine-grained security model (access control lists and optional password encryption) for securing passwords that are stored in Windows Server Active Directory
40
−- Support for the Entra role-based access control model for securing passwords that are stored in Microsoft Entra ID
41
+- Support for the Microsoft Entra role-based access control model for securing passwords that are stored in Microsoft Entra ID
4142
4243
## Informational videos
4344
⋯ 25 unchanged lines
6970
7071
Whether a device is joined to Microsoft Entra ID or Windows Server Active Directory determines how you can use Windows LAPS.
7172
72
−Devices that are joined only to [Microsoft Entra ID](/azure/active-directory/devices/concept-azure-ad-join) can back up passwords only to Microsoft Entra ID.
73
−
74
−Devices that are joined only to Windows Server Active Directory can back up passwords only to Windows Server Active Directory.
73
+- Devices that are joined only to [Microsoft Entra ID](/azure/active-directory/devices/concept-azure-ad-join) can back up passwords only to Microsoft Entra ID.
74
+- Devices that are joined only to Windows Server Active Directory can back up passwords only to Windows Server Active Directory.
75
+- Devices that are [hybrid-joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid) (joined to both Microsoft Entra ID and Windows Server Active Directory) can back up their passwords either to Microsoft Entra ID or to Windows Server Active Directory.
7576
76
−Devices that are [hybrid-joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid) (joined to both Microsoft Entra ID and Windows Server Active Directory) can back up their passwords either to Microsoft Entra ID or to Windows Server Active Directory. You can't back up passwords to both Microsoft Entra ID and Windows Server Active Directory.
77
+You can't back up passwords to both Microsoft Entra ID and Windows Server Active Directory.
7778
7879
Windows LAPS doesn't support Microsoft Entra workplace-joined clients.
7980
8081
## Set Windows LAPS policy
8182
82
−To set up and manage policy for your Windows LAPS deployment, you have multiple options:
83
+To set up and manage policies for your Windows LAPS deployment, you have multiple options:
8384
8485
- [Windows LAPS configuration service provider (CSP)](/windows/client-management/mdm/laps-csp)
8586
- [Windows LAPS Group Policy](laps-management-policy-settings.md#windows-laps-group-policy)
⋯ 5 unchanged lines
9192
9293
Options for Windows include:
9394
94
−- The Windows Server Active Directory Users and Computers properties dialog
95
−- A dedicated event log channel
96
−- A Windows PowerShell module that's specific to Windows LAPS
95
+- The Windows Server Active Directory Users and Computers properties dialog.
96
+- A dedicated event log channel.
97
+- A Windows PowerShell module that's specific to Windows LAPS.
9798
9899
Azure-based monitoring and reporting solutions are available when you back up passwords to Microsoft Entra ID.
99100
100
−## Deprecation of legacy Microsoft LAPS product
101
+## Deprecation of the legacy Microsoft LAPS product
101102
102103
> [!IMPORTANT]
103
−> NOTE: The [legacy Microsoft LAPS product](https://www.microsoft.com/download/details.aspx?id=46899) is deprecated as of Windows 11 23 H2 and later. Installation of the legacy Microsoft LAPS MSI package is blocked on newer OS versions, and Microsoft no longer considers code changes for the legacy Microsoft LAPS product.
104
+> The [legacy Microsoft LAPS product](https://www.microsoft.com/download/details.aspx?id=46899) is deprecated as of Windows 11 23H2 and later. Installation of the legacy Microsoft LAPS Microsoft Installer (MSI) package is blocked on newer OS versions, and Microsoft no longer considers code changes for the legacy Microsoft LAPS product.
104105
>
105
−> Use Windows LAPS, available on Windows Server 2019 and later, and on supported Windows 10 and Windows 11 clients, for managing local administrator account passwords.
106
+> Use Windows LAPS for managing local administrator account passwords. Windows LAPS is available on Windows Server 2019 and later, and on supported Windows 10 and Windows 11 clients.
106107
>
107
−> Microsoft will continue to support the legacy Microsoft LAPS product on older versions of Windows (prior to Windows 11 23 H2) on which it was previously supported. That support will end upon the normal end of support for those OS versions.
108
+> Microsoft will continue to support the legacy Microsoft LAPS product on older versions of Windows (earlier than Windows 11 23H2) on which it was previously supported. That support will end upon the normal end of support for those OS versions.
108109
109110
## Windows LAPS vs. legacy Microsoft LAPS
110111
⋯ 3 unchanged lines
114115
> Windows LAPS doesn't require you to install legacy Microsoft LAPS. You can fully deploy and use all Windows LAPS features without installing or referring to legacy Microsoft LAPS. But to help migrate an existing legacy Microsoft LAPS deployment, Windows LAPS offers [legacy Microsoft LAPS emulation mode](laps-scenarios-legacy.md).
115116
116117
> [!IMPORTANT]
117
−> The legacy Microsoft LAPS product is deprecated on newer Microsoft OS versions. For more information, see [Deprecation of legacy Microsoft LAPS product](laps-overview.md#deprecation-of-legacy-microsoft-laps-product).
118
+> The legacy Microsoft LAPS product is deprecated on newer Microsoft OS versions. For more information, see [Deprecation of the legacy Microsoft LAPS product](laps-overview.md#deprecation-of-the-legacy-microsoft-laps-product).
118119
119120
## Support statement
120121
121122
Microsoft released the legacy Microsoft LAPS product in calendar year 2016 on the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=46899). Windows LAPS shipped as part of Windows Updates released on April 11, 2023, for the platforms listed in [Windows LAPS and Microsoft Entra ID](laps-overview.md#windows-laps-and-microsoft-entra-id).
122123
123
−Microsoft and its support delivery organization offer assisted support for both Microsoft LAPS and Windows LAPS including interoperability between the two products.
124
+Microsoft and its support delivery organization offer assisted support for both Microsoft LAPS and Windows LAPS, including interoperability between the two products.
124125
125126
> [!IMPORTANT]
126
−> The legacy Microsoft LAPS product is deprecated on newer Microsoft OS versions. For more information, see [Deprecation of legacy Microsoft LAPS product](laps-overview.md#deprecation-of-legacy-microsoft-laps-product).
127
+> The legacy Microsoft LAPS product is deprecated on newer Microsoft OS versions. For more information, see [Deprecation of the legacy Microsoft LAPS product](laps-overview.md#deprecation-of-the-legacy-microsoft-laps-product).
127128
128
−Microsoft strongly recommends that customers begin planning now to migrate their Windows LAPS-capable systems from using legacy Microsoft LAPS over to the new Windows LAPS feature. Windows LAPS offers many new security features and improved product servicing.
129
+We strongly recommend that you begin planning now to migrate your Windows LAPS-capable systems from using legacy Microsoft LAPS over to the Windows LAPS feature. Windows LAPS offers many new security features and improved product servicing.
129130
130
−Questions about limitations and\or interoperability concerns between third-party local account password management tools and Windows LAPS should be directed to the third-party application developer, not Microsoft.
131
+Questions about limitations and interoperability concerns between third-party local account password management tools and Windows LAPS should be directed to the third-party application developer, not Microsoft.
131132
132133
## Licensing requirements
133134
⋯ 7 unchanged lines
141142
142143
## Submit feedback
143144
144
−Want to send us feedback? Feel free to submit document-specific questions via the Feedback links at the bottom of this page.
145
+Want to send us feedback? Feel free to submit document-specific questions via the feedback links at the bottom of this page.
145146
146147
You can also submit feedback and other requests via the [Windows LAPS feedback](https://aka.ms/WindowsLAPSFeedback) Tech Community page.
147148
⋯ 6 unchanged lines
154155
- [Introducing Windows Local Administrator Password Solution with Microsoft Entra ID](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/introducing-windows-local-administrator-password-solution-with/ba-p/1942487)
155156
- [Windows Local Administrator Password Solution in Microsoft Entra ID](https://aka.ms/cloudlaps)
156157
- [Windows Local Administrator Password Solution with Microsoft Entra ID now Generally Available!](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/windows-local-administrator-password-solution-with-microsoft/ba-p/3911999)
157
−- [Windows Local Administrator Password Solution in Microsoft Entra ID](/azure/active-directory/devices/howto-manage-local-admin-passwords).
158
+- [Windows Local Administrator Password Solution in Microsoft Entra ID](/azure/active-directory/devices/howto-manage-local-admin-passwords)
158159
- [Microsoft Intune support for Windows LAPS](/mem/intune/protect/windows-laps-overview)
159160
- [Windows LAPS CSP](/windows/client-management/mdm/laps-csp)
160
−- [Windows LAPS Troubleshooting Guidance](/troubleshoot/windows-server/windows-security/windows-laps-troubleshooting-guidance)
161
+- [Windows LAPS troubleshooting guidance](/troubleshoot/windows-server/windows-security/windows-laps-troubleshooting-guidance)
161162
- [LAPS PowerShell module reference](/powershell/module/laps)
162163
- [Legacy Microsoft LAPS](https://www.microsoft.com/download/details.aspx?id=46899)
163164
164165
## Next steps
165166
166167
- [Key concepts in Windows LAPS](laps-concepts-overview.md)
167
−- [Get started with Windows LAPS for Windows Server Active Directory](laps-scenarios-windows-server-active-directory.md)
168
−- [Get started with Windows LAPS for Microsoft Entra ID](laps-scenarios-azure-active-directory.md)
168
+- [Get started with Windows LAPS and Windows Server Active Directory](laps-scenarios-windows-server-active-directory.md)
169
+- [Get started with Windows LAPS and Microsoft Entra ID](laps-scenarios-azure-active-directory.md)
169170
- [Get started with Windows LAPS in legacy Microsoft LAPS emulation mode](laps-scenarios-legacy.md)
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:37 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.