Blog Post

Windows IT Pro Blog
4 MIN READ

By popular demand: Windows LAPS available now!

JaySimmons's avatar
JaySimmons
Icon for Microsoft rankMicrosoft
Apr 11, 2023
Welcome to the new and improved Windows LAPS! That's Local Administrator Password Solution. We've been listening to your feedback and requests, and the day is finally here for both cloud and on-premi...
Updated Nov 09, 2023
Version 7.0
security
servicing and updates
JaySimmons's avatar
JaySimmons
Icon for Microsoft rankMicrosoft
Apr 21, 2023

AndyLeonhard  

 

>> Does anybody have any ideas for how to handle this scenario? It feels like this is expected but perhaps unintended behavior.

 

Yes this behavior is expected.  However, I will be brutally honest right here in this public forum and admit that I did not anticipate the potential impact of the Windows LAPS "legacy LAPS emulation mode" on preexisting OS deployment workflows (for example MDT workflows like you are using).

 

There are two ways to get past this.  The preferred option would be to modify your workflow so that you initially join the machine to a clean (no linked GPOs) staging OU, and then move the machine to the final destination OU as the very last step, at which point the legacy LAPS policy (or new Windows LAPS policy) will get applied to the device and honored.  If that approach is not adaptable for your current workflow, then you will want to control if\when Windows LAPS starts enforcing the legacy LAPS policy by using the registry key documented here.