Local administrator passwords often remain unchanged because changing them breaks an emergency workflow. Windows LAPS addresses that problem by managing and backing up the password of a local administrator account on Microsoft Entra-joined or Windows Server Active Directory-joined devices. The security benefit depends on more than a rotation interval. It also depends on who can retrieve the password, how long a retrieved password remains valid after use, and whether the device is healthy enough to complete the rotation.
Windows LAPS architecture documents a usage-triggered rotation option: when the managed account authenticates to the managed device, the service can initiate a password change. This is valuable after a support session or a suspected exposure. A long rotation interval alone leaves a copied password usable until its scheduled replacement.
Review the retrieval path
Password custody is part of the authentication boundary. Microsoft documents role requirements for retrieving clear-text passwords, including default administrative roles in the cloud scenario. Those roles become high-value targets. Review who holds them, whether standing access is necessary, and whether retrieval is visible in audit logs. A user who can read the backup without a business reason can defeat the local password policy.
For Active Directory storage, enable password encryption. For Microsoft Entra ID, account for the documented recovery limits. If a device is deleted, Microsoft Intune documentation says there is no Entra ID method to recover a managed password for that deleted device unless a custom external workflow stored it. Recovery planning should not depend on an object that may already be gone.
Test the state transitions
A policy can be correctly assigned and still fail to produce a usable new password. Intune documentation notes that a rotate request fails when the device has not successfully backed up account data. Build a test that covers the normal scheduled rotation, a manual rotation, a retrieval, and a rotation triggered by password use. After each step, verify the old password no longer authenticates, the new backup exists, and the expected owner can retrieve it.
Set a grace period that matches the operational need. The grace period exists so a person can finish a task after retrieval, but it also extends the window in which the disclosed credential remains valid. Record the approved duration, restrict retrieval to the people who need the access, and alert when a device repeatedly triggers rotations. Repeated changes may indicate automation probing the local account or a broken backup process.
Retire legacy Microsoft LAPS on supported systems as part of the migration plan. Running two password-management mechanisms can create conflicting policy and unclear recovery ownership. Measure completion by device coverage, successful backup after rotation, retrieval audit coverage, and verification that old passwords fail. A configuration dashboard that reports "LAPS enabled" is only the start.