Windows LAPS on Windows Server 2025: Active Directory Deployment Guide

In short

Windows LAPS (Windows Local Administrator Password Solution) is built into Windows Server 2025. You do not install the legacy Microsoft LAPS MSI. Windows LAPS automatically rotates a managed local administrator password and backs it up to either Windows Server Active Directory or Microsoft Entra ID.

For an Active Directory deployment, extend the LAPS schema once, delegate OU permissions, configure a computer-side LAPS policy with BackupDirectory = 2, process policy, verify Event ID 10018, and retrieve passwords only through authorized identities. Raff Technologies recommends enabling AD password encryption when your domain functional level and access model support it.

What is Windows LAPS?

Windows LAPS is Microsoft's current local administrator password-management feature for Windows. It regularly changes the password of a managed local administrator account and stores the password in a protected directory location where authorized administrators can retrieve it.

Microsoft documents Windows LAPS for:

• Windows Server 2025;
• Windows Server 2022 with supported updates;
• Windows Server 2019 with supported updates;
• supported Windows 11 and Windows 10 releases.

Windows LAPS can back passwords up to:

• Windows Server Active Directory for domain-joined devices;
• Microsoft Entra ID for Microsoft Entra-joined devices.

A hybrid-joined device can use either destination, but Windows LAPS does not back the same managed password up to both directories at the same time.

Windows LAPS vs legacy Microsoft LAPS

The old product is commonly called Microsoft LAPS or legacy LAPS. Windows LAPS is the newer implementation built directly into supported Windows versions.

Microsoft has deprecated the legacy Microsoft LAPS product on newer Windows versions. For Windows Server 2025, use Windows LAPS, not the old MSI.

How to install Windows LAPS on Windows Server 2025

There is no separate Windows LAPS installer for Windows Server 2025. If you searched for how to install LAPS 2025 or Windows LAPS download, the important point is that the supported Windows LAPS feature is already part of the operating system.

Verify the native module instead of downloading LAPS.x64.msi:

Get-Module -ListAvailable LAPS
Get-Command -Module LAPS

If the module is unexpectedly missing, verify the Windows Server image and patch state first. Do not solve that problem by installing a legacy LAPS package from an old tutorial.

How Windows LAPS works with Active Directory

A normal Active Directory deployment looks like this:

Managed Windows Server or workstation
        |
        | Windows LAPS policy
        v
Local administrator password rotated
        |
        | encrypted before directory backup when configured
        v
Active Directory computer object
        |
        +--> authorized password readers
        +--> authorized password reset operators

The managed computer performs the password rotation locally. It then writes the password information to its own Active Directory computer object, assuming the OU permissions and LAPS policy are configured correctly.

Password access is controlled in two layers:

1. Active Directory ACLs decide who can query the LAPS password attributes.
2. Password encryption can further limit who can decrypt an encrypted password.

For encrypted passwords in Active Directory, Microsoft requires a Windows Server 2016 domain functional level or later.

Prerequisites

Before deploying Windows LAPS, verify:

• Active Directory is healthy.
• DNS works correctly for domain members.
• Managed devices are domain-joined.
• The managed OS supports Windows LAPS.
• Windows updates are current enough for Windows LAPS on Server 2019/2022 devices.
• You have rights to extend the Active Directory schema.
• You have a dedicated OU or a clear OU scope for managed devices.
• You have decided who may retrieve local administrator passwords.
• You have a test computer before applying policy broadly.
• Your domain functional level is Windows Server 2016 or later if you want encrypted AD passwords.

For production, do not test the first LAPS policy on every server in the domain. Start with one OU and one non-critical system.

Step 1 — Verify the Windows LAPS PowerShell module

On Windows Server 2025, open PowerShell as Administrator and run:

Get-Module -ListAvailable LAPS

Then list the available cmdlets:

Get-Command -Module LAPS

Important Windows LAPS cmdlets include:

Step 2 — Update the Active Directory schema

Before Windows LAPS can store password information in Active Directory, extend the schema.

Run this once per forest:

Update-LapsADSchema -Verbose

Microsoft documents this as a one-time forest operation.

You can run it on a supported domain controller or another supported server that has access to the LAPS PowerShell module and the required directory permissions.

Do not repeatedly run schema updates as part of normal workstation or server onboarding.

Step 3 — Put managed devices in a dedicated OU

A dedicated OU makes LAPS policy and delegation easier to understand.

Example:

contoso.com
  └── Servers
      └── LAPS-Managed-Servers

You can create one with PowerShell:

New-ADOrganizationalUnit `
  -Name 'LAPS-Managed-Servers' `
  -Path 'OU=Servers,DC=contoso,DC=com'

Move one test computer into the OU before applying policy broadly.

For an MSP, separate OUs by customer or administrative boundary rather than giving one support group unrestricted LAPS access to unrelated client systems.

Step 4 — Allow managed computers to update their own LAPS password

Each managed computer needs permission to update its LAPS password information on its own Active Directory computer object.

Set-LapsADComputerSelfPermission `
  -Identity 'OU=LAPS-Managed-Servers,OU=Servers,DC=contoso,DC=com'

Verify the returned object matches the OU you intended to modify.

Do not grant this permission at the domain root unless you deliberately want that scope.

Step 5 — Create a dedicated LAPS password-readers group

Avoid making every help-desk administrator a Domain Admin just so they can retrieve a local password.

New-ADGroup `
  -Name 'LAPS-Password-Readers' `
  -SamAccountName 'LAPS-Password-Readers' `
  -GroupScope Global `
  -GroupCategory Security `
  -Path 'OU=Groups,DC=contoso,DC=com'

Add only administrators who actually need local-password recovery access. Use a separate group for password-reset/expiration rights when duties should be separated.

Step 6 — Delegate password-read permission

Set-LapsADReadPasswordPermission `
  -Identity 'OU=LAPS-Managed-Servers,OU=Servers,DC=contoso,DC=com' `
  -AllowedPrincipals 'CONTOSO\LAPS-Password-Readers'

Members of Domain Admins already have password-query permission by default.

Important: permission to read LAPS attributes is not automatically permission to decrypt an encrypted password. If AD password encryption is enabled, the authorized decryptor is controlled separately by ADPasswordEncryptionPrincipal.

Step 7 — Delegate password-reset permission separately

Set-LapsADResetPasswordPermission `
  -Identity 'OU=LAPS-Managed-Servers,OU=Servers,DC=contoso,DC=com' `
  -AllowedPrincipals 'CONTOSO\LAPS-Password-Resetters'

This permission allows an authorized operator to change the LAPS password-expiration time. It does not let the operator choose a specific replacement password.

Step 8 — Audit who has LAPS rights before rollout

Before storing privileged local passwords in Active Directory, inspect existing extended rights:

Find-LapsADExtendedRights `
  -Identity 'OU=LAPS-Managed-Servers,OU=Servers,DC=contoso,DC=com'

Review the output for unexpected principals. This is particularly important in older AD environments where inherited delegation may have accumulated over time.

Step 9 — Create and link a Windows LAPS Group Policy

Open Group Policy Management:

gpmc.msc

Create a GPO such as:

Servers - Windows LAPS

Link it only to the managed computer OU first.

Edit:

Computer Configuration
→ Policies
→ Administrative Templates
→ System
→ LAPS

Windows includes the Windows LAPS administrative template at:

%windir%\PolicyDefinitions\LAPS.admx

If your environment uses a Group Policy Central Store, Windows Update does not automatically copy the LAPS ADMX/ADML files into that store. Maintain the Central Store deliberately.

Step 10 — Configure the minimum Windows LAPS policy

For an Active Directory deployment, the minimum critical setting is the backup destination.

Configure password backup directory

Set the backup directory to Active Directory. At the policy-data level:

BackupDirectory = 2

If BackupDirectory is not configured, the remaining LAPS settings do not create a usable password-backup workflow.

Administrator account to manage

If you leave AdministratorAccountName unconfigured, Windows LAPS manages the built-in local Administrator account using its well-known RID, even if that account has been renamed.

If you configure a custom account in manual account-management mode, make sure the account already exists.

Password settings

Microsoft currently documents defaults including:

Windows Server 2025 also supports newer password-generation options. PasswordComplexity = 5 uses a readability-focused character set, and Server 2025 can generate random passphrases using the newer passphrase complexity modes. These Server 2025 features do not require upgrading every domain controller to Server 2025; they depend on the managed device supporting the policy.

Step 11 — Enable Active Directory password encryption

For Windows Server Active Directory, Windows LAPS can encrypt the password before directory backup.

The relevant policy is:

ADPasswordEncryptionEnabled

This requires Windows Server 2016 domain functional level or later.

The decryptor is controlled by:

ADPasswordEncryptionPrincipal

If ADPasswordEncryptionPrincipal is not configured, Windows LAPS encrypts the password so that the managed device's Domain Admins group is the authorized decryptor.

If you need a different operational boundary, configure a dedicated group, for example:

CONTOSO\LAPS-Password-Readers

Windows LAPS supports one encryption principal. If several teams need decryption rights, use a wrapper security group rather than attempting to configure several principals independently.

Step 12 — Apply Group Policy to the test computer

On the managed server:

gpupdate /force

Confirm the GPO is applied:

gpresult /r

For a detailed report:

gpresult /h C:\Temp\LAPS-GPResult.html

If the GPO is missing, fix OU scope, link state, security filtering, replication, or DNS before troubleshooting LAPS itself.

Step 13 — Force Windows LAPS policy processing

Windows LAPS processes active policy periodically. During a controlled test, trigger it immediately:

Invoke-LapsPolicyProcessing

The cmdlet itself is not the final proof of success. Verify the event log and directory state afterward.

Step 14 — Verify Event IDs 10018 and 10020

For Active Directory backup, Microsoft documents:

• Event ID 10018 — Windows LAPS successfully updated Active Directory with the new password.
• Event ID 10020 — Windows LAPS successfully updated the managed local administrator account.

For Microsoft Entra ID backup, the directory-update success event is 10029 instead of 10018.

Query the operational log after policy processing and confirm the expected success event for your backup destination.

Step 15 — Retrieve the local administrator password

From an authorized administrative system:

Get-LapsADPassword `
  -Identity 'SERVER01' `
  -AsPlainText

When AD password encryption is enabled, useful output fields include:

• Source;
• DecryptionStatus;
• AuthorizedDecryptor;
• PasswordUpdateTime;
• ExpirationTimestamp.

A healthy encrypted-password result normally shows Source : EncryptedPassword and DecryptionStatus : Success.

Fix “the account's password is encrypted but you do not have permission to decrypt it”

This error is not the same as lacking permission to query the AD attributes.

If Get-LapsADPassword can find the object but shows an unauthorized decryption status, check:

1. whether ADPasswordEncryptionEnabled is enabled;
2. which principal is configured in ADPasswordEncryptionPrincipal;
3. the AuthorizedDecryptor returned by Get-LapsADPassword;
4. whether the administrator is actually a member of that decryptor group;
5. whether group-membership changes have propagated and the administrator has a fresh logon token.

Granting Set-LapsADReadPasswordPermission alone does not override encrypted-password decryption policy. The user needs both the directory read access and the ability to decrypt the password under the configured encryption principal.

Security warning for -AsPlainText

-AsPlainText intentionally displays the credential in clear text. Do not paste LAPS passwords into tickets, screenshots, chat, scripts, or ordinary log files.

Step 16 — Test an early password rotation

From Active Directory, an authorized operator can expire the stored password:

Set-LapsADPasswordExpirationTime -Identity 'SERVER01'

At the next policy-processing cycle, the managed computer rotates the password. To process immediately on the managed computer:

Invoke-LapsPolicyProcessing

For an exceptional immediate local rotation:

Reset-LapsPassword

After rotation, retrieve the password again and confirm the password and timestamps changed.

Step 17 — Use Windows Server 2025 automatic account management deliberately

Windows Server 2025 supports Windows LAPS automatic account management. This is different from the default manual mode.

In manual mode:

• leave AdministratorAccountName empty to manage the built-in Administrator account;
• or point it at a custom local account that you provision separately.

In automatic account-management mode, Windows LAPS can manage more of the local account lifecycle, including creation of a custom managed account, account naming, enabling/disabling the account, and optional randomized account naming.

Automatic account management is supported on Windows Server 2025 and Windows 11 24H2 or later. Treat it as a separate design decision rather than enabling it automatically during the first LAPS rollout.

Windows LAPS can manage domain-controller DSRM passwords

Windows LAPS can also manage and back up Directory Services Restore Mode (DSRM) passwords on Active Directory domain controllers.

That is a separate recovery scenario from member-server local Administrator management. Define who may retrieve the DSRM password and how domain-controller recovery is documented before enabling it.

Windows LAPS security best practices

Use a dedicated OU first

Start with one test OU. Do not make a new LAPS policy domain-wide before validating it.

Use dedicated reader and resetter groups

Avoid assigning broad Domain Admin rights to help-desk staff simply to retrieve local passwords.

Audit extended rights

Use Find-LapsADExtendedRights before assuming only your new delegation groups can query LAPS attributes.

Prefer encrypted AD passwords

For a Windows Server 2016 or later DFL, enable AD password encryption and deliberately define the decryptor.

Do not copy passwords into permanent records

LAPS passwords are temporary privileged credentials. Treat clear-text retrieval as a sensitive administrative action.

Keep the local account separate from domain administration

Windows LAPS solves the reusable local-admin-password problem. It does not replace separate domain-admin accounts, MFA, Windows Firewall, patching, monitoring, or privileged-access controls.

For broader host security, use the Windows Server Hardening Checklist.

Recommended MSP rollout model

For MSP-managed Windows environments, align LAPS administrative boundaries with the client boundary.

Client A Servers OU
→ Client A LAPS GPO
→ Client A LAPS Readers group
→ Client A LAPS Resetters group

Client B Servers OU
→ Client B LAPS GPO
→ Client B LAPS Readers group
→ Client B LAPS Resetters group

Avoid one global support group that can retrieve every customer's local administrator password unless that broad access is deliberate and audited.

For each client, document OU scope, GPO name, managed account mode, backup destination, read/reset groups, encryption principal, test device, retrieval test, and incident rotation procedure.

Common Windows LAPS deployment mistakes

Installing legacy Microsoft LAPS on Windows Server 2025

Windows LAPS is built into Windows Server 2025. Do not follow an old MSI-based tutorial for a new deployment.

Updating the schema but forgetting OU permissions

Schema extension does not automatically let managed computer objects write their LAPS information. Apply Set-LapsADComputerSelfPermission at the intended OU scope.

Giving read permission but not decryption permission

When AD password encryption is enabled, ACL read permission alone does not guarantee the administrator can decrypt the password.

Setting AdministratorAccountName to the renamed built-in Administrator

Leave the setting empty when managing the built-in Administrator account. Windows identifies it by RID.

Configuring a custom account that does not exist in manual mode

Manual account-management mode does not create the custom account for you. Windows Server 2025 automatic account management is the separate feature that can manage custom-account creation.

Leaving BackupDirectory unconfigured

Without the backup destination, the deployment does not produce the intended directory-backed password workflow.

Assuming gpupdate proves LAPS worked

gpupdate /force shows that Group Policy was processed. Verify Windows LAPS itself with Events 10018/10020 and the backed-up password state.

Troubleshooting Windows LAPS

Use this order when a password does not appear or cannot be retrieved:

1. Confirm the device is domain-joined.
2. Confirm the OS supports Windows LAPS.
3. Confirm the native LAPS PowerShell module is available.
4. Confirm Update-LapsADSchema completed for the forest.
5. Confirm the computer object is in the intended OU.
6. Confirm Set-LapsADComputerSelfPermission was applied to that OU.
7. Confirm the Windows LAPS GPO applies to the computer.
8. Confirm BackupDirectory = 2 for the AD scenario.
9. Run Invoke-LapsPolicyProcessing.
10. Check the Windows LAPS operational log for 10018/10020 or error events.
11. Check AD, DNS, and replication health.
12. Run Find-LapsADExtendedRights to audit unexpected delegation.
13. Retrieve with Get-LapsADPassword from an authorized identity.
14. If DecryptionStatus is unauthorized, inspect ADPasswordEncryptionPrincipal and AuthorizedDecryptor rather than simply adding more AD read permissions.

Do not weaken permissions or disable encryption as the first troubleshooting step.

Where Raff fits

Raff Windows VMs can provide Windows Server infrastructure for Active Directory domain controllers, member servers, RDS environments, SQL Server, and other workloads where Windows LAPS is useful.

Windows LAPS itself is an operating-system and identity-management control. You still design the Active Directory topology, private networking, OU structure, Group Policy, delegation, domain-controller redundancy, backups, privileged access, monitoring, and recovery.

For production Active Directory, avoid a single domain controller and avoid exposing AD services directly to the public internet.

Frequently asked questions

Is Windows LAPS built into Windows Server 2025?

Yes. Windows LAPS is native to Windows Server 2025. You do not need the legacy Microsoft LAPS MSI for a new Server 2025 deployment.

What is the difference between Windows LAPS and Microsoft LAPS?

“Microsoft LAPS” often refers to the older standalone product. Windows LAPS is the Windows-native implementation with Active Directory and Microsoft Entra ID backup, AD password encryption, DSRM support, and newer account-management features.

Does Windows LAPS require Active Directory?

No. Windows LAPS can back passwords up to Windows Server Active Directory or Microsoft Entra ID depending on join state and policy. This guide covers Active Directory.

Does Windows LAPS create the local administrator account?

In default manual mode, no. Windows Server 2025 also supports automatic account management, which can create and manage a custom local account when configured.

What domain functional level is required for encrypted LAPS passwords?

Windows Server 2016 domain functional level or later is required for Windows LAPS password encryption in Active Directory.

How do I retrieve a Windows LAPS password from Active Directory?

Use an authorized identity:

Get-LapsADPassword -Identity 'SERVER01' -AsPlainText

How do I force Windows LAPS to process policy now?

Run:

Invoke-LapsPolicyProcessing

For AD backup, Event ID 10018 confirms the new password was successfully written to Active Directory.

How do I immediately rotate the managed local password?

Run Reset-LapsPassword locally for an exceptional immediate rotation, or expire the AD password with Set-LapsADPasswordExpirationTime and then process policy.

Validation scope

This article was revalidated on September 10, 2026 against Microsoft's current Windows LAPS overview, Active Directory deployment guidance, policy-setting reference, architecture documentation, account-management modes, password/passphrase guidance, event-log reference, and LAPS PowerShell behavior. No fresh Raff lab test was claimed for this refresh.

What's next

• Promote a Windows VPS to an Active Directory Domain Controller
• Active Directory Group Policy Setup from Scratch
• Windows Server Hardening Checklist
• Configure Windows Firewall on a Windows VPS
• Raff Windows VM

Sources

• Microsoft Learn — Windows LAPS overview: https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview
• Microsoft Learn — Windows LAPS with Windows Server Active Directory: https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-scenarios-windows-server-active-directory
• Microsoft Learn — Windows LAPS architecture: https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-concepts-overview
• Microsoft Learn — Configure Windows LAPS policy settings: https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-policy-settings
• Microsoft Learn — Windows LAPS account management modes: https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-concepts-account-management-modes
• Microsoft Learn — Windows LAPS passwords and passphrases: https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-concepts-passwords-passphrases
• Microsoft Learn — Windows LAPS event logs: https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log
• Microsoft Learn PowerShell — LAPS module: https://learn.microsoft.com/en-us/powershell/module/laps/?view=windowsserver2025-ps
• Sources revalidated: 2026-09-10