[22h2] Local Admin Password Solution now built in!

[psydii]

LAPS is built into Windows 10 and 11 Edu and Enterprise as of today’s (11th April 2023) Windows update.

 

Improvements over the legacy version include password encryption, AD Directory Service Restore mode password management, and automatic rotation of passwords after use.

 

Integration with Azure AD is in preview.

 

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/by-popular-demand-windows-laps-available-now/ba-p/3788747

[foofighterjim]

Wish I hadn't wasted my time in setting this up a few weeks ago, also worth noting that if you do have the legacy version that Aprils update breaks it: https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-laps-is-incompatible-with-legacy-policies/

[psydii]

Wish I hadn't wasted my time in setting this up a few weeks ago

 

It's good for the soul.

 

The bugs apparently are where Legacy LAPS is installed after the April update has been applied, and where April Update has been applied but Legacy LAPS is not installed and Legacy LAPS GPO Settings apply.

 

https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview#legacy-laps-interop-issues-with-the-april-11-2023-update

 

 

Simplest solution for us will be to uninstall Legacy LAPS and Legacy LAPS GPO settings, replacing them with functional equivalents from the modern LAPS policy options.

[Koldov]

Does this work on LTSB machines...?

 

I configured this last week and 99% of my machines have converted and stored a password in AD.

 

However I noticed a few missing and it appears they are the 1% of machines still on LTSB (the others are all on LTSC)...

 

All in the same OU, all show GPO applied with RSoP/GPResult, all have the correct local admin account, all have the correct registry entries.

[robintech]

Is there a procedure for using LAPS if you're going to the physical machine and logging in as admin locally, do you write down the password and reset it afterwards kind of thing?

[Koldov]

I think how you manage it is up to you, but there is a GPO to reset it after it has been used.

 

https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-policy-settings#postauthenticationactions:~:text=to%2024%20hours.-,PostAuthenticationActions,-Use%20this%20setting