Using Windows Local Admin Password Solution (Windows LAPS)

[@edelbeneatp]

Not quite as fast as you made it seem - you forgot to put the 4 after client4 in the PC name, so you actually had a wrong username, hence the password error. Either way, this is cool tech and I'm glad Microsoft finally implemented this.

[@DeanEllerbyMVP]

very well spotted! I didn't notice that!

[@illwill718]

First thing I noticed lol Very helpful video overall

[@jigsaw4770]

Thanks for sharing Dean! For those out there who don’t know, in place of long computer names, you can specify “.\” in place of the of the full computer name before the local admin account

[@CocalicoPCTech]

Definitely a cool feature. We don't have remote access enabled yet. They keep saying it will be coming soon and free for education but... we wait. Once we get it I may utilize this feature. For now I just have a custom configuration profile that creates the local admin we use.

[@danzirulez]

One very important thing - Autopilot actually disables the built-in Administrator account by default. One should really use a designated group or user from Intune to allow administering the devices. This is only needed if all else fails, but then Cfg profile has to be set to re-enable the built-in admin user - and again, it's is STRONGLY advised to rename that account :) Thanks Dean for another cool vid :)

[@DeanEllerbyMVP]

Thanks! I couldn’t figure out what scenario caused the built in account to be disabled and it didn’t happen on my test VMs (not AP) so I left that out of the video. Thanks for clarifying!

[@cli3335]

Isn't better to create a new local administrator account then use LAPS to change the password and leave the original administrator account disabled?

[@62128Kevin]

02:40 you type client\Iadmin but in the beginning it was client4\Iadmin but it's ok. There is a way for some users to get their own password themselves ? For tech people for example, but not for the sales. Because if each time users have UAC and need to get their own password, it could be bother for the IT support to give their password which one rotate each 15 days for example

[@DeanEllerbyMVP]

Well spotted. I wish it was a deliberate mistake :-) Windows LAPS has full RBAC support, so you could grant specific users with permission to retrieve passwords. It would be difficult (but not impossible) to limit them to getting their own computer’s password, rather than everyone’s password.

[@jan_bakker]

Thanks for this! Quick tip: .\ladmin will do the same as client4\ladmin

[@kevinjackson5191]

If you don't have a feature that actively saves clipboard strokes (other than the built-in clipboard), then i've found that you cannot paste a password into a UAC window on Windows 11. The amount of time i've had to write it down and type it in is frustrating. When the UAC windows pops up everything else on the screen loses focus so you can't even have the password showing on a notepad for example next to the UAC window. Hope that makes sense and that something else has the same frustrations ?

[@daywork1849]

I have created the police inside Intune and I see the devices are coming inside, but I didn't get any local password inside the Devices? would you help me

[@TheJakebaw]

Hi Did you find out why local password didnt appear in device? I'm getting the same problem.

[@daywork1849]

@@TheJakebaw Hi, that was long time. you need to enable configurations. I had test them then you need to assign device t the user.

[@djordjenovakovic2847]

How can the end user see his password when he needs it? Do we need to use new powershell LAPS module and read it from Microsoft Graph? Thanks

[@patrick__007]

Thanks for uploading. My test devices still doesn't show the LAPS from the Devices blade in Intune. I've created the LAPS policy several days ago as well the check box ticked in AzureAD - Devices. Eventlog from this devices are showing that the LAPS is succeeded...

[@froggmann01]

I encountered this in my test group. Make sure the admin account is enabled. It's not by default. It appears LAPS doesn't work on disabled accounts.

[@patrick__007]

@@froggmann01 I did enable the default Administrator account. Will check this today

[@HenSan-sm7mx]

If the device loses connection, no internet whatsoever -- will that device be able to use the last rotated password, does that stay in local cache -or- is an internet connection needed for the LAPS password to work?

[@DeanEllerbyMVP]

I believe it works the same way as the original LAPS. If the device cannot confirm (both sides) that a new password has been set, then it does not attempt to change it.

[@eyadabu-khiran1919]

Thanks for the demo. I think that the reason why your login failed following the reboot was because you used "client" as the machine name and not "client4". It's possible also that the new password has taken effect. To login locally I use ".\localuseraccount"

[@DeanEllerbyMVP]

Agreed! You are correct, it was probably because I typed the computer name wrong. I do often use .\ to login locally, but I seemed to forget this time around 😀