Windows Local Administrator Password Solution with Microsoft Entra ID now generally available!

Hi PetterHaa ,

Yes - that is an issue we plan to address in future.  No ETA at this point though.

Jay

Deleted ,

I think you are looking at the legacy LAPS Intune settings - the old-vs-new naming conflict can cause confusion.   

EDIT: you may have been already aware of this distinction, if so apologies and back to Sandeep Deo for your original request.

When you create an Intune policy for Windows LAPS, you should see something that looks like this:

Assuming your Intune mgmt portal looks the same as mine, you should be able to create a Windows LAPS policy via the following workflow:

Endpoint Security -> Account protection -> Create Policy -> set Platform to "Windows 10 and later" -> set Profile to "Local admin password solution (Windows LAPS".

Side note:  the legacy LAPS Intune settings were managed via straightforward ADMX registry mappings, as opposed to an inbox CSP which is what Windows LAPS supports.

hth,

Jay

Hi.

Thanks for a great feature!

Are there any plans of adding functionality where we are able to customize which letters, numbers and characters are being used in the generated passwords?

For instance the number zero 0 and the letter O and the letters l and I are quire similar, and adds extra time to process when using these passwords.

Dear Sandeep Deo

thank you for this magnificient addition and work on Windows LAPS.

Some parts in regards of Windows Server are unclear to me and I hope you can shed some light. 

It is true that Windows LAPS can either save secrets to Entra ID (GPO says Azure AD) and local AD DS. 

The announcement of Merill reads like Entra ID is required. I understand that yours and Merill's announcement focus on Windows LAPS for Entra ID, but should differentiate that is also possible to use it on-premises only for Windows Server and, if one wants to also Windows Client. 

I have few questions on the mentioned hybrid join or Entra only joined devices. 

Q: What is the preferred procedere to join Windows Server to Entra ID only or Hybrid?

Asking because Windows Server Core (GUI less) doesn't offer dsregcmd, very unfortunately.

Q: can we bring dsregcmd to Windows Server Core for feature parity. It exist on the GUI variant?

Q: I could imagine that joining Windows Server through Azure Arc is enough to make it hybrid joined. Is it? How about Entra Only, is it possible? 

Q: Does Windows LAPS work with Entra Directory Services (former Azure AD Domain Controllers)?

another question: 

for easier adoption, is it planned that CSP policies will be merged into settings catalog? This would be very helpful
https://learn.microsoft.com/windows/client-management/mdm/laps-csp

edit:

LAPS is in the settings catalog. Is this one complete or do we still need to tinker with CSP policies?

edit2: unfortunately, the settings catalog is incomplete and won't help to get Windows LAPS activated.

Sandeep Deo would you mind to ask internally, that the Windows LAPS settings will be included into settings catalog for easier configuration? Thank you very much in advance!

Does all this is recommended even in a cloud only-scenario? All devices are signed to Entra ID and managed by Intune. Local admin and guest accounts are disabled.

Deleted ,

>>since ADPasswordEncryptionPrincipal is missing in Endpoint security > account security policy,

>>do I assume correctly this one needs to be added via custom CSP policies and this AD (Entra AD synced) group need the correct permissions?

If you are trying to backup passwords to the cloud (Entra), then the answer is no.  There are multiple on-premises AD-specific settings provided which are only applicable when backing passwords up to on-premises AD.    When you are backing passwords to Entra (via the Backup Directory setting in Intune), these settings are hidden from you.  So if I am understanding your question correctly, this is expected behavior.   Note that password retrieval authorization is managed differently (via RBAC, etc) when passwords are backed up to Entra.  Also there is no way to store a non-encrypted password to Entra - the data is always protected.

>>I do not see the password in devices > deviceid > local admin password. Have not checked Eventlog yet. 

Please also make sure you have enabled Windows LAPS in your tenant's Devices configuration blade. This is a one-time, additional directory preparation step that is required when backing passwords up to Entra.   You can find the instructions here:

Enabling Windows LAPS with Microsoft Entra ID

Make sure that is enabled, then wait an hour to see if the device(s) are now able to successfully update their passwords to Entra.

If it is still not working at that point, please run the Get-LapsDiagnostics cmdlet on one of the afflicted devices and PM me the resultant zip file.

Thx,

Jay

Hi Deleted ,

>>Does all this is recommended even in a cloud only-scenario? All devices are signed to Entra ID and managed by Intune. Local admin and guest accounts are disabled.

The whole point of deploying Windows LAPS is to preserve the ability to login into a managed device with a Windows _local_ account.  Many customers consider this capability to be very useful for things like helpdesk admin and device recovery scenarios; and yes this is true even in cloud-only deployment scenarios.  Regular rotation of the managed local account's password is considered critical for general security reasons.  Windows LAPS provides these benefits in a robust, built-into-Windows package, improved even more with the (now in GA) ability to store the passwords to Entra.

That all said, if you don't see yourself ever needing the additional benefits that I described, then you may not want to deploy the solution.

Jay

Thank you Deleted and JaySimmons we always find more practical autopilot reset and start fresh with any device causing troubles from apps or bad configuration, Intune for baseline policies, installing apps and remote help or quick assist does an excellent job.

Karl-WE

>>It is true that Windows LAPS can either save secrets to Entra ID (GPO says Azure AD) and local AD DS. 

It is either Entra ID or local AD DS and not both.

>>The announcement of Merill reads like Entra ID is required. I understand that yours and Merill's announcement focus on Windows LAPS for Entra ID, but should differentiate that is also possible to use it on-premises only for Windows Server and, if one wants to also Windows Client. 

The announcement focuses primarily on Entra ID support for Windows LAPS.

>>What is the preferred procedere to join Windows Server to Entra ID only or Hybrid?

>>Asking because Windows Server Core (GUI less) doesn't offer dsregcmd, very unfortunately.

We do not support Microsoft Entra hybrid join on Windows Server Core SKU.

>>can we bring dsregcmd to Windows Server Core for feature parity. It exist on the GUI variant?

I can follow up, but this decision was based to minimize footprint.

>>I could imagine that joining Windows Server through Azure Arc is enough to make it hybrid joined. Is it? How about Entra Only, is it possible? 

Arc enabling Windows Server and Microsoft Entra hybrid join are two different things and independent of each other. You can make an Arc enabled Windows Server (if it is domain joined), a Microsoft Entra hybrid join device, assuming it is a supported SKU. For list on unsupported scenarios, see Plan your Microsoft Entra hybrid join deployment | Microsoft Learn

>>Does Windows LAPS work with Entra Directory Services (former Azure AD Domain Controllers)?

No, Windows LAPS is not supported with Microsoft Entra Domain Services.