Many customers have asked me in passing when Windows LAPS will be supported for managed devices joined to an Entra AD Domain Services domain (formerly known as Azure AD Domain Services). All I can share for now is that the owning team is aware of this ask and it is in their backlog. Please up-vote this feature to add your support!   It would also be helpful if you are willing to PM me with your company name and the # of EADDS\AADDS devices that would be Windows LAPS-enabled once the support is available.   Overview of Microsoft Entra Domain Services - Microsoft Entra ID | Microsoft Learn   thanks, Jay ... View more

Please add support for passphrases on LAPS where we can use four words dash (-) separated. It makes supporting a device remotely way easier since the password cannot be copied and pasted over remote sessions on most cases. There is too much ambiguity on charactes like “lower case L” “capital case i” and “pipe” and others. Thanks ... View more

Many customers have asked for Windows LAPS to support a suitable replacement for the legacy LAPS UI (AdmPwd.UI.exe). Yes we have the new LAPS tab in ADUC but it seems many customers don't use ADUC that much, especially for helpdesk workers.  Also, ADUC does not have the ability to display password history (frankly there's just not enough UI real-estate left in that dialog).   I would really like to hear feedback from customers on what scenarios a new Windows LAPS UI should support. Off the top of my head, it should:   1. Support targeting of a specific forest 2. Support searching for a specific computer account by various name forms, or by object picker 3. Support setting of the password expiration timestamp 4. Support retrieving of both the current password and password history   A more exotic idea would be a "RDP Connect to device" button which would combine 1) pwd retrieval; 2) on-the-fly creation of an RDP shortcut with password; 3) launching the RDP client.     Looking forward to hearing other suggestions on this topic! 🙂 ... View more

Create an opt-in configuration option that tells the LAPS service to not use certain characters in LAPS-generated passwords, such as o, O, 0, l, 1, etc. ... View more

Currently LAPS by default act on built-in local administrator user. If you want to have a new one you have to crate using different method. I think the possibility to specify a custom administrator account and have Intune create it will be very helpfull. ... View more

Would make things easier if Microsoft implement new Features for all supported OS Versions not only for the newest.    Windows Server 2012 Windows Server 2012 R2 Windows Server 2016 Windows 10 LTSC ... ... View more

Posting this myself since I've heard this feedback multiple times from customers.  Termination of individual processes is useful when OTS (over-the-shoulder) elevation scenarios are being used.  (OTS scenario is where the LAPS password is used to launch an individual app via rite-click->RunAsAdministrator.) ... View more

Hello,   Some customers do not really on ADUC anymore for AD operations, but on Active Directory Administrative Center (which replaced ADUC when released) and Windows Admin Center (Active Directory extension). It would be nice if Windows LAPS tabs where also available on these tools.   Regards, ... View more

Hello, I am looking for a feature similar to legacy LAPS that allows a separately defined user in the domain to access the reading of LAPS-assigned passwords. This feature is called "auditing mode" and is used in Legacy LAPS by my C# application to read out certain passwords from devices. I am now looking for a way to integrate this process into my programme for Windows LAPS through a specified domain user and C#. ... View more

Currently, in Entra's LAPS, you can filter reports by "Last password rotation" and "Next password rotation"  It would be beneficial to also have a LAPS filter for "Password Has Expired", enabling us to take a proactive approach in investigating instances where password rotations have not occurred on specific managed devices. ... View more

Please correct our ability to reset a password from the 365 Admin Center.  The ability is offered and even appears to work by sending you a confirmation email, but of course it does not work.  How can MS have this option even available if they won't support it. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-writeback Supports password writeback when an admin resets them from the Microsoft Entra admin center: When an admin resets a user's password in the Microsoft Entra admin center, if that user is federated or password hash synchronized, the password is written back to on-premises. This functionality is currently not supported in the Office admin portal. ... View more

Encountered a scenario where the a custom local account was configured for LAPS management via Intune Profile (./Device/Vendor/MSFT/LAPS/Policies/AdministratorAccountName) now we want to switch it back to have LAPS manage the built-in Local admin Via Intune Profile, set AdministratorAccountName back to Not Configured allowed time for policy to sync (and manual sync a few times + Invoke-LapsPolicyProcessing) and we find the custom account is still being managed by LAPS, (LAPS events confirm this) we find the registry key for AdministratorAccountName is still present.. when we might assume it would be removed automatically since the Policy was reversed to a Not Configured state Is this a bug or expected behavior?  If expected, that means we need to delete this registry key or LAPS will not switch to the built-in Admin.   ... View more

I'm in the process of deploying LAPS but am a bit confused about what is needed to deploy GPOs for Windows LAPS on older domain controllers. The FAQ says it is not required to update/extend the AD schema if I'm storing passwords in Azure AD but older DCs don't have the LAPS ADMX files needed to build GPOs that configure Windows LAPS to store passwords in Azure AD.   It might be helpful to clarify this in the documentation. If the solution is simply to copy ADMX files from a Win10/11 machine into the DC's sysvol folders so we can "see" the Windows LAPS policy settings, then it would be good to mention that in the docs. ... View more

Hello, Windows LAPS requires Active Directory schema update to be fully functional - such updates are often quite difficult to implement on large environments, due the amount of operational risks and approvals tied to them. With LAPS now part of the operating system instead of being on a third-app level, it would make sense to add corresponding attributes and classes to default AD schema when building a new Active Directory. Maybe for Windows Server vNext, which will include several AD enhancements for the first time in many years ?   Regards,   ... View more

how can you carry the above transition swiftly? Currently, we have on-prem LAPS install however we want to move to the new  Windows Laps any ideas? ... View more

Hey,   i tested out the laps automatic mode from the latest canary build   first of all, thank you for your work   i would like to know if this feature will be extended to windows 10 or will this only be on windows 11?   sincerely ... View more

Hello Team, I'm having a issue with a device, LAPS is changing the administrator password every hour and login me off. this is happening since this week. ... View more

Some of our servers are non persistent and are created from a template each night. If the Password needs updating logic checked the local admin account's PasswordLastSet and AD msLAPS-PasswordExpirationTime, LAPS would work perfectly for us.  The password would update and stay in sync with the Win LAPS password. Yes, I know I could disable the local admin account through policy and choose not to use LAPS on the non-persistent servers, or add a script that clears the password last change date in AD on startup.   I would prefer not to have to keep separate GPOs to resolve this issue or custom hacks to resolve something that could just be built in. It could even be an optional setting in the LAPS GPO. Example: Check local admin account last password set: True.             ... View more

We have user device which reset LAPS password three times a week while the policy is set to reset every 365 days.    The current LAPS policy is configured as follows: Policy source: CSP Backup directory: Azure Active Directory Local administrator account name: local.adm Password age in days: 365 Password complexity: 3 Password length: 12 Post authentication grace period (hours): 24 Post authentication actions: 0x1   Password updates when Event log shows below.  The post-authentication grace period has expired per policy. The configured post-authentication actions will now be executed. Account name: Local.adm Account RID: 0x3E9   How can we fix this and stop resetting the password.  ... View more