Helpdesk needs the local admin password for a locked-out laptop. You open Entra admin center > Devices > [device] > Local administrator password recovery (or Intune Devices > Local admin password) and either there is no password, or the timestamp is weeks old. The Windows LAPS configuration profile in Intune says Succeeded. Someone suggests rebooting, then force-rotating, then reinstalling the policy.
Windows LAPS stores the managed local account password in Entra ID (cloud-backed) or Active Directory (on-prem backed). When rotation "stops," the failure is usually one of: the wrong policy channel, the account name, backup directory, client-side CSP processing, or a permission/role gap on the reader. This post is a read-first order for that ticket. Every step only reads until you decide a change is justified.
TL;DR
- Confirm you are on Windows LAPS (the modern CSP / Intune setting catalog), not legacy Microsoft LAPS (AdmPwd). They do not share a password store.
- On the device: is the managed account present, and do Event Viewer channels under Microsoft-Windows-LAPS/Operational show successful backup or a clear error?
- In Intune: does the policy target the device, is Backup directory set to Entra ID (or AD, if that is the design), and is the Administrator account name exact?
- In Entra: can your role actually read the password? Device.Read is not enough for recovery.
- Do not force-rotate or rename the local admin until BitLocker recovery keys are escrowed and you have a recent LAPS event that explains the stall.
What "not rotating" usually means
Three different tickets get mixed under the same label:
| What the admin sees | What it often is | First read |
|---|---|---|
| No password in Entra / Intune UI | Never backed up, wrong backup directory, or reader lacks permission | Device LAPS events + your Entra role |
| Password present but months old | Rotation interval not reached, device offline, or backup failing after first success | Last successful backup time vs policy interval |
| Policy "Succeeded" but account unchanged | Wrong account name, account missing, or legacy LAPS still owning the password | Local Get-LocalUser + LAPS Operational log |
| On-prem AD has a password, Entra does not | Backup directory is Active Directory, not Entra ID | Policy Backup directory setting |
Windows LAPS on Entra-joined and hybrid-joined devices can back up to Entra ID. Domain-joined devices can back up to Active Directory. Mixing those expectations is the most common false failure.
Step 1: Confirm Windows LAPS, not legacy LAPS
Legacy Microsoft LAPS (the old AdmPwd GPO / client-side extension) writes to AD attributes like ms-Mcs-AdmPwd. Windows LAPS is a different stack: Intune Settings Catalog / configuration profile, Windows CSP, and (for cloud) Entra recovery APIs.
On the laptop (elevated PowerShell is fine for these reads):
# Is the modern LAPS service / CSP path present?
Get-Service -Name 'LAPS*' -ErrorAction SilentlyContinue |
Select-Object Name, Status, StartType
# Legacy CSE still installed? (presence alone is a yellow flag)
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -ErrorAction SilentlyContinue
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd' -ErrorAction SilentlyContinue
If you still have an AdmPwd GPO targeting the same computers, treat that as a design conflict until someone owns a single path. Do not assume Intune "Succeeded" means the modern client wrote to Entra.
Step 2: Read the policy the device actually got
In Intune admin center > Devices > Configuration, open the Windows LAPS profile (Settings Catalog: Local Administrator Password Solution (Windows LAPS) or the dedicated Windows LAPS template).
Check these fields against the ticket:
| Setting | What to verify |
|---|---|
| Backup directory |
Azure AD / Entra ID for cloud recovery; Active Directory only if on-prem recovery is intentional |
| Administrator account name | Exact local account (often a renamed admin, not Administrator) |
| Password age / rotation | Interval in days; a 30-day age on a device last online 2 days ago is not a bug |
| Password complexity / length | Must be within Windows LAPS supported ranges |
| Post-authentication actions | Logoff / reboot after use — can confuse "it rotated immediately after I retrieved it" tickets |
Then confirm assignment:
- Device in a group the profile targets?
- Any exclusion filter removing Autopilot, kiosk, or server SKUs by accident?
- Profile status on the device blade: Succeeded vs Pending vs Error (Error text matters more than the green count on the profile overview).
Step 3: On the device — account + Operational log
Still on the laptop:
$acct = '.\YourLapsAdminName' # match the policy account name
Get-LocalUser | Where-Object {
$_.Name -eq ($acct -replace '^\.\\','') -or $_.SID -like '*-500'
} | Select-Object Name, Enabled, SID, PasswordLastSet, PasswordRequired
If the named account does not exist, Windows LAPS cannot rotate it until the account is created (or the policy points at an account that does). Creating accounts is a change — note it, do not invent one mid-ticket without a change window.
Open Event Viewer > Applications and Services Logs > Microsoft > Windows > LAPS > Operational.
Useful patterns:
| Event theme (wording varies by build) | Meaning | Next read |
|---|---|---|
| Password successfully backed up to Azure AD / Entra | Client side is healthy | Reader permissions / wrong device object in the portal |
| Backup failed / authorization / directory | Cloud or AD write failed | Network to login.microsoftonline.com; device join state; AD permissions if on-prem backup |
| Policy not applied / CSP | Profile not arriving | Sync, assignment, filter |
| Account not found | Name mismatch | Policy account name vs Get-LocalUser
|
| Rotation postponed / not due | Age not reached | Compare PasswordLastSet / last backup to interval |
Also confirm join/enrollment quickly (read-only):
$dsreg = dsregcmd /status
$dsreg | Select-String 'AzureAdJoined|DomainJoined|WorkplaceJoined|MDMUrl|TenantName'
Cloud backup needs a device identity Entra recognizes. AzureAdJoined : NO with an Entra backup directory is a design mismatch, not a LAPS bug.
Step 4: Retrieve path — Entra UI and who can read
In Microsoft Entra admin center > Identity > Devices > All devices > [device] > Local administrator password recovery (wording can vary slightly), or from Intune Devices > [device] > Local admin password.
If the UI is empty:
- Confirm you opened the same device object the laptop uses (
dsregcmdDeviceId vs portal Device ID). - Confirm your role. Typical readers need a privileged role that includes LAPS password read (for example roles that Microsoft documents for Windows LAPS recovery — Global Admin, Cloud Device Admin, Intune Admin, and custom roles with the LAPS password read permission). Being able to see the device list is not the same as being able to reveal the secret.
- If backup directory is Active Directory, stop looking in Entra — use the AD recovery tooling /
Get-LapsADPasswordpath your org standardized on.
A minimal Graph-oriented inventory of whether a password exists (not the secret itself) belongs in a break/fix pack; for the ticket, the portal reveal plus the Operational log is enough. Do not paste recovered passwords into chat, tickets, or screenshots.
Step 5: Rotation timeline before you force anything
Only after the reads above:
| Situation | Prefer | Avoid |
|---|---|---|
| Never backed up, account missing | Create/rename per standard, sync, wait for next policy cycle | Random local admin names per tech |
| Backed up once, age not due | Wait or document a controlled rotate | Daily manual resets that hide policy bugs |
| Backup failing with a clear event | Fix join, network, AD ACL, or backup directory | Re-assigning the same broken profile |
| Password needed now for break/fix | Retrieve current value if present; rotate after the session per your post-auth policy | Sharing one static local admin across the fleet |
If you must trigger an on-demand rotation, do it from the supported admin path your tenant uses (Intune/Entra device action or documented PowerShell), after BitLocker keys are confirmed escrowed. Treat rotate as a change with an owner and a rollback note.
FAQ
Does Windows LAPS replace the built-in Administrator account automatically?
No. You choose the account name in policy. Many orgs rename or disable Administrator and manage a dedicated local admin. The SID-500 account is common but not required if the policy names another local user that exists.
Can I use legacy Microsoft LAPS and Windows LAPS together?
Not as a dual-write design. Pick one. Migrate with a clear cutover: stop AdmPwd targeting, deploy Windows LAPS, confirm backup events, then retire the old GPO.
Why does Intune show Succeeded but Entra has no password?
Succeeded usually means the CSP settings applied. Backup is a later client action that needs the account, network, and directory. Read LAPS Operational events on the device.
Hybrid joined — Entra or AD backup?
Either can be valid. Match Backup directory to where helpdesk is trained to recover. If recovery runbooks say "Entra device blade," the policy must back up to Entra ID.
Will retrieving the password rotate it immediately?
Only if post-authentication actions / your process say so. Some tenants configure automatic rotation after use. Tell helpdesk before they copy the password so they are not surprised by a mid-call change.
Related posts
- Company Portal can't connect / device not syncing: a 10-minute triage order for Intune admins
- Hybrid Azure AD Join Pending: A Read-First Triage Order for Entra Connect Admins
- BitLocker still encrypting: why Intune marks you noncompliant and how grace periods save Monday
- An offboarding checklist for M365 / Intune admins: disable vs delete, license reclaim, and the device decision
Free checklist
Local admin recovery sits next to Conditional Access and compliance in every break/fix drill. If you are tightening device requirements, the free Conditional Access pre-enforcement checklist keeps pilot groups, report-only review, and join state on one page before you enforce:
If you collect enrollment and device hygiene notes for the team, the Intune & M365 Admin Starter Pack includes enrollment hygiene, break/fix cards, and a read-only local enrollment snapshot that pairs well with LAPS Operational checks: https://cashflow4375.gumroad.com/l/joonf?utm_source=devto&utm_medium=article&utm_campaign=aps_first_sale&utm_content=windows-laps-not-rotating
Admin Pack Studio; not affiliated with Microsoft. The commands above only read. Test Windows LAPS account naming and backup directory changes in a pilot group first. Never paste recovered LAPS passwords into tickets or chat.
Top comments (0)