LAPS Passwords Should Always Be Removed from AD When switching to Entra password backup

In our deployment of Windows LAPS, we've discovered two scenarios where the Legacy LAPS password details persists in Active Directory even though the device is now using Windows LAPS: When changi...

JaySimmons

Microsoft

Sep 12, 2025

Hi bmkaiser00 - ok I can repro your scenario #1 (when BackupDirectory is flipped from AD -> Entra). I cannot repro your scenario #2 (flipping password complexity from password to passphrase).

Would you please re-confirm your repro on scenario #2? If you can still repro it, please run the Get-LapsDiagnostics cmdlet before and after the policy change, and upload the resultant zip files to me. If that doesn't work, I may need to work with you directly to gather some debug traces.

thx,

Jay

bmkaiser00

Copper Contributor

Sep 16, 2025

Hello JaySimmons - Thank you for confirming scenario #1!

After looking deeper, scenario #2 was a configuration issue on our end. We unknowingly still had the Legacy LAPS client installed on our Windows Server 2025 instances. After removing the client from those hosts, the Legacy LAPS password disappeared from AD for each computer object within 48 hours of its expiration.

JaySimmons
Microsoft
Sep 22, 2025
That is good news.

I have edited the title of this submission to better capture the fact that the bug is on any Windows LAPS policy migration from BackupDirectory=AD to BackupDirectory=Entra.

Thanks again for reporting this.