Post-authentication actions

ComputerIntune-readyLAPS_PostAuthenticationActions

Supported on At least Microsoft Windows 10 or later

25H2 · 1.0

What it does

This policy configures post-authentication actions which will be executed after detecting an authentication by the managed account. Grace period: specifies the amount of time (in hours) to wait after an authentication before executing the specified post-authentication actions. If this setting is enabled and greater than zero, the specified post-authentication actions will be executed upon expiration of the grace period. If this setting is disabled or not configured, the specified post-authentication actions will be executed after a default 24 hour grace period. If this setting is equal to zero, no post-authentication actions will be executed. Actions: specifies the actions to take upon expiration of the grace period. Reset password: upon expiration of the grace period, the managed account password is reset. Reset the password and logoff the managed account: upon expiration of the grace period, the managed account password is reset and any interactive logon sessions using the managed account are logged off. Reset the password and reboot: upon expiration of the grace period, the managed account password is reset and the managed device is rebooted. Reset the password, logoff the managed account, and terminate any remaining processes: upon expiration of the grace period, the managed account password is reset, any interactive logon sessions using the managed account are logged off, and any remaining processes are terminated. (NOTE: after any interactive logon sessions are terminated there may still be other authenticated sessions in use by the managed account. The only robust way to ensure that the previous password is longer in use is to reboot the device.) If this setting is disabled or not configured, post-authentication actions will default to "Reset the password and logoff the managed account". Note: the DSRM account on domain controllers cannot be configured for post-authentication actions. This policy has no effect on domain controllers and will be ignored even if configured for a DC. See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.

What it writes

Hive: HKEY_LOCAL_MACHINE
Registry key: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS

In Intune

No native CSP; import the ADMX (Intune-ready).

From Microsoft's Policy CSP DDF files (DDF v2 Files, February 2026), read 18 Oct 2026.

Options

Option	Type	Registry value	Allowed values
Grace period (hours)Default: 24	Number	`PostAuthenticationResetDelay`	0 to 24
ActionsDefault: Reset the password and logoff the managed account	Drop-down list	`PostAuthenticationActions`	Disabled - take no actions`0` Reset the password`1` Reset the password and logoff the managed account`3` Reset the password and reboot the device`5` Reset the password, logoff the managed account, and terminate any remaining processes`11`

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Enabled · Computer · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS]
"PostAuthenticationActions"=dword:00000003
"PostAuthenticationResetDelay"=dword:00000018

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Post-authentication actions
# Name: LAPS_PostAuthenticationActions
# Scope: Machine
# State: Enabled
# Source: LAPS.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -Name 'PostAuthenticationResetDelay' -PropertyType 'DWord' -Value 24

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -Name 'PostAuthenticationActions' -PropertyType 'DWord' -Value 3

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.

ADMX profile candidate (OMA-URI)

./Device/Vendor/MSFT/Policy/Config/ADMX_LAPS/LAPS_PostAuthenticationActions

ADMX SyncML candidate

<SyncML xmlns="SYNCML:SYNCML1.2">
  <SyncBody>
    <Replace>
      <CmdID>1</CmdID>
      <Item>
        <Meta>
          <Format>chr</Format>
          <Type>text/plain</Type>
        </Meta>
        <Target>
          <LocURI>./Device/Vendor/MSFT/Policy/Config/ADMX_LAPS/LAPS_PostAuthenticationActions</LocURI>
        </Target>
        <Data>&lt;enabled/&gt;
&lt;data id="LAPS_PostAuthenticationResetDelay_INT" value="24"/&gt;
&lt;data id="LAPS_PostAuthenticationActions" value="3"/&gt;</Data>
      </Item>
    </Replace>
    <Final/>
  </SyncBody>
</SyncML>

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Post-authentication actions
# Name: LAPS_PostAuthenticationActions
# Scope: Machine
# State: Enabled
# Source: LAPS.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -Name 'PostAuthenticationResetDelay' -Kind 'DWord' -Expected 24
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS\PostAuthenticationResetDelay') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -Name 'PostAuthenticationActions' -Kind 'DWord' -Expected 3
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS\PostAuthenticationActions') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Post-authentication actions
# Name: LAPS_PostAuthenticationActions
# Scope: Machine
# State: Enabled
# Source: LAPS.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -Name 'PostAuthenticationResetDelay' -PropertyType 'DWord' -Value 24

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -Name 'PostAuthenticationActions' -PropertyType 'DWord' -Value 3

History 5 retained releases

24H2 · 1.030 Sep 2024
- Description … and greater than zero, the specified…expir~~[removed: y]~~[added: ation] of the grace period. If this setting is d…expir~~[removed: y]~~[added: ation] of the grace period. Reset password: upon expir~~[removed: y]~~[added: ation] of the grace period, the managed account password ~~[removed: will be ]~~[added: is ]reset. Reset the password and logoff the managed account: upon expir~~[removed: y]~~[added: ation] of the grace period, the managed account password …
  Whole description, marked
  This policy configures post-authentication actions which will be executed after detecting an authentication by the managed account. Grace period: specifies the amount of time (in hours) to wait after an authentication before executing the specified post-authentication actions. If this setting is enabled and greater than zero, the specified post-authentication actions will be executed upon expir~~[removed: y]~~[added: ation] of the grace period. If this setting is disabled or not configured, the specified post-authentication actions will be executed after a default 24 hour grace period. If this setting is equal to zero, no post-authentication actions will be executed. Actions: specifies the actions to take upon expir~~[removed: y]~~[added: ation] of the grace period. Reset password: upon expir~~[removed: y]~~[added: ation] of the grace period, the managed account password ~~[removed: will be ]~~[added: is ]reset. Reset the password and logoff the managed account: upon expir~~[removed: y]~~[added: ation] of the grace period, the managed account password ~~[removed: will be]~~[added: is reset and any interactive logon sessions using the managed account are logged off. Reset the password and reboot: upon expiration of the grace period, the managed account password is] reset and [added: the managed device is rebooted. Reset the password, logoff the managed account, and terminate ]any [added: remaining processes: upon expiration of the grace period, the managed account password is reset, any ]interactive logon sessions using the managed account ~~[removed: will]~~[added: are logged off, and any remaining processes are] terminated. (NOTE: after any interactive logon sessions are terminated there may still be other authenticated sessions in use by the managed account. The only robust way to ensure that the previous password is longer in use is to reboot the device.)~~[removed: Reset the password and reboot: upon expiry of the grace period, the managed account password will be reset and the managed device will be immediately rebooted.]~~ If this setting is disabled or not configured, post-authentication actions will default to "Reset the password and logoff the managed account". Note: the DSRM account on domain controllers cannot be configured for post-authentication actions. This policy has no effect on domain controllers and will be ignored even if configured for a DC. See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.
- “Actions” gains the choice [added: Reset the password, logoff the managed account, and terminate any remaining processes (11)]
- Editor controls or their defaults changed.
23H2 · 1.015 Jul 2024
- Template definition changed; registry values, options and limits are the same.
22H2 · 3.015 Jul 2024
- Added in this release.

1 later release left it unchanged.

Template

Internal name: LAPS_PostAuthenticationActions
Namespace: Microsoft.Policies.LAPS
Template file: LAPS.admx
Release: Windows 11 25H2 · 1.0 · file set de4e49983ebd651f…

Definition, editor controls and support

Definition

<policy class="Machine" displayName="$(string.LAPS_PostAuthenticationActions)" explainText="$(string.LAPS_PostAuthenticationActions_Help)" key="SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS" name="LAPS_PostAuthenticationActions" presentation="$(presentation.LAPS_PostAuthenticationActions)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.LAPS:LAPS_CAT" />
      <supportedOn ref="Microsoft.Policies.LAPS:SUPPORTED_Windows10" />
      <elements>
        <decimal id="LAPS_PostAuthenticationResetDelay_INT" maxValue="24" minValue="0" valueName="PostAuthenticationResetDelay" />
        <enum id="LAPS_PostAuthenticationActions" valueName="PostAuthenticationActions">
          <item displayName="$(string.PostAuthenticationActions_Item0)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.PostAuthenticationActions_Item1)">
            <value>
              <decimal value="1" />
            </value>
          </item>
          <item displayName="$(string.PostAuthenticationActions_Item3)">
            <value>
              <decimal value="3" />
            </value>
          </item>
          <item displayName="$(string.PostAuthenticationActions_Item5)">
            <value>
              <decimal value="5" />
            </value>
          </item>
          <item displayName="$(string.PostAuthenticationActions_Item11)">
            <value>
              <decimal value="11" />
            </value>
          </item>
        </enum>
      </elements>
    </policy>

Editor controls

<presentation id="LAPS_PostAuthenticationActions" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <decimalTextBox defaultValue="24" refId="LAPS_PostAuthenticationResetDelay_INT">Grace period (hours):</decimalTextBox>
        <dropdownList defaultItem="2" refId="LAPS_PostAuthenticationActions">Actions:</dropdownList>
      </presentation>

Supported platforms and category

Microsoft.Policies.LAPS:category:LAPS_CAT
<category displayName="$(string.LAPS)" name="LAPS_CAT" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:System" />
    </category>
Microsoft.Policies.LAPS:definition:SUPPORTED_Windows10
<definition displayName="$(string.SUPPORTED_Windows10)" name="SUPPORTED_Windows10" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Windows:category:System
<category displayName="$(string.System)" explainText="$(string.System_Help)" name="System" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.LAPS:category:LAPS_CAT
<category displayName="$(string.LAPS)" name="LAPS_CAT" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:System" />
    </category>
<strings><string id="Microsoft.Policies.LAPS:LAPS">LAPS</string></strings>
Microsoft.Policies.LAPS:definition:SUPPORTED_Windows10
<definition displayName="$(string.SUPPORTED_Windows10)" name="SUPPORTED_Windows10" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.LAPS:SUPPORTED_Windows10">At least Microsoft Windows 10 or later</string></strings>
Microsoft.Policies.Windows:category:System
<category displayName="$(string.System)" explainText="$(string.System_Help)" name="System" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:System">System</string><string id="Microsoft.Policies.Windows:System_Help">Allows configuration of various system component settings.</string></strings>