--- title: Simplifying Windows Local Administrator Password Solution (LAPS) Configuration with Intune. Part II description: SQL Server 2012 is finally getting the boot! What are you going to do about it? --- [AMTRA Solutions | Blog](https://www.amtrasolutions.com/blog) # [Simplifying Windows Local Administrator Password Solution (LAPS) Configuration with Intune. Part II](https://www.amtrasolutions.com/blog/laps_config-part2) Written by [AMTRA Solutions](https://www.amtrasolutions.com/blog/author/amtra-solutions) | Jul 27, 2023, 5:26:45 PM In [Part I](https://www.amtrasolutions.com/blog/laps_configuration) of our blog Simplifying Windows LAPS Configuration with Intune, we talked about the necessary pre-requisites, and went over the first part in our comprehensive approach to enhancing local administrator account management.  Now, let’s embark on the second stage of our implementation journey - Enabling and Configuring Windows LAPS (Local Administrator Password Solution). In this crucial step, we dive into the configuration settings and options, unleashing the power of Windows LAPS to enhance the security and management of local administrator passwords. By taking advantage of this robust solution, you'll fortify your organization's defenses and streamline password administration. This Part 2 is further divided into 3 steps that need to be performed to Setup Windows LAPS in your Intune Environment: 1. Enable Windows LAPS for your Tenant. 2. Enable Password Management via Configuration Profile 3. Setup Account Protection Policy for LAPS under Endpoint Protection.  **Enable LAPS for your Tenant** - Sign-in to the [**Azure portal**](http://www.portal.azure.com) as a [**Cloud Device Administrator**](https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#cloud-device-administrator)**.** - Browse to **Azure Active Directory** \> **Devices** \> **Device settings**. - Select **Yes** for the ***Enable Local Administrator Password Solution (LAPS)*** setting and select **Save**. Enable Password Management via Configuration Profile Go to [Microsoft Intune admin center](https://intune.microsoft.com/). Navigate to Devices \> Windows \> Configuration Profiles. Create on Create profile. Platform: Windows 10 or later. Profile type: Settings Catalog. **Policy Configuration Settings** **Basics** Name: **LAPS – Enable Password Management** Description: **This policy enables password management for Windows LAPS.** (Change it as per your requirement) **Configuration Settings** - Select Add Settings Search and Enable: **Enable Local Admin Password Management** Search and Enable: Accounts Enable Administrator Account Status (Optional) Note | Only Enable the above Accounts Enable Administrator Account Status setting if you are using your default administrator account as local administrator. - Close this **Settings Picker** by clicking on **X** Toggle the **required** **Settings** based on your requirement to **Enable**: - Scope tags - Create tags based on your organization requirements (Optional) - Assignments - Assign the group to respective devices group to deploy this setting. - Review + create - Create **Create Account Protection Policy for LAPS** Make sure you are in [Microsoft Intune admin center](https://intune.microsoft.com/). Navigate to **Endpoint Security** \> **Account Protection** Click on Create policy Platform: **Windows 10 or later** Profile: **Local admin password solution (Windows LAPS) (preview)** Click on **Create** **Policy Configuration Settings** **Basics** Name: **LAPS Policy** Description: **Enter a brief description** Platform: **Windows 10 and later** **Configuration Settings** Backup Directory: **Backup the password to Azure AD only** (select based on your requirement. You can only have one selected out of AD or AAD and cannot create both policies for backup directory). Password Age Days: **7** (select anywhere between 1-365 \[AD\] or 7-365 \[AAD\]. [Learn more](https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/?WT.mc_id=Portal-fx)) Administrator Account Name: Configured ***localadmin*** (Enter the name of the local admin account you created in **PART 1** or use the one which you already have in your environment. If you want to use your default local admin account, then ignore this setting and let it to **Not Configured** [Learn more](https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/?WT.mc_id=Portal-fx)). Password Complexity**:** Large letters + small letters + number + special characters ([Learn more](https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/?WT.mc_id=Portal-fx)) Password Length: **Configured** - 14 (Characters, check with your security team, [Learn more](https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/?WT.mc_id=Portal-fx)) - Post Authentication Actions: Reset the password and logoff the managed account (Select the settings based on your org requirements. [Learn more](https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/?WT.mc_id=Portal-fx)). - Post Authentication Reset Delay**: Configured** - 6 (In hours, [Learn more](https://docs.microsoft.com/windows/client-management/mdm/LAPS-csp/?WT.mc_id=Portal-fx)) **Verification of the implementation** Now that the configuration has been implemented, it's time to validate the effectiveness of our setup by verifying our ability to retrieve passwords from Intune. This step ensures that our implementation is functioning as intended and that we can successfully access the passwords associated with the local administrator accounts. Let's proceed with the verification process and ensure that all the pieces of our configuration puzzle are securely in place. **Intune** To fetch the password via [**Intune portal**](https://intune.microsoft.com/) follow the below steps: 1. Sign in to [Microsoft Intune admin center](https://intune.microsoft.com/) 2. Go to **Devices** \> Select **any device** for which you want to see the **password**. 3. Click on **Local Admin Password** on the left pane. 1. Click on **Show local administrator password** 2. **Click** on **the Copy** **button** or **show** to retrieve the password from right pane under **Local administrator password.** Alternatively, you can also retrieve the password from Azure Portal by following below steps: 1. Login to [**Azure Portal**](http://www.portal.azure.com) 2. Open **Azure Active Directory** and select **Devices** 3. Click on **Local administrator password recovery (Preview)** from the left pane to retrieve passwords. **Conclusion** We have now explored the step-by-step process of configuring Windows LAPS (Local Administrator Password Solution) with Intune. By completing the prerequisites, deploying local admin accounts, and enabling Windows LAPS, you have fortified security and streamlined password management across devices. With the ability to retrieve passwords from Intune and Azure AD, you now have full control over local administrator accounts. We encourage you to share your experience or ask any questions you may have. Thank you for joining us on this implementation journey, and may your administrative practices be secure and efficient. [View full post](https://www.amtrasolutions.com/blog/laps_config-part2) ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "AMTRA Solutions" }, "dateModified" : "2024-02-13T21:29:20.306Z", "datePublished" : "2023-07-27T17:26:45Z", "headline" : "Simplifying Windows Local Administrator Password Solution (LAPS) Configuration with Intune. Part II", "image" : { "@type" : "ImageObject", "height" : 1260, "url" : "https://3938893.fs1.hubspotusercontent-na1.net/hubfs/3938893/AMTRA%20Blog/Configuration%20with%20Intune%20%20%281%29.jpg", "width" : 2240 }, "mainEntityOfPage" : "https://www.amtrasolutions.com/blog/laps_config-part2", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "height" : 60, "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png", "width" : 60 }, "name" : "AMTRA SOLUTIONS BLOG" } } ```