Windows LAPS: Deploy It Safely and Recover the Local Administrator After a Restore

Direct answer: Use the Windows LAPS feature built into Windows Server 2019 and later (with the April 2023 update or later) rather than the deprecated legacy Microsoft LAPS. For Active Directory backup, extend the schema once with Update-LapsADSchema, grant each managed OU self-write with Set-LapsADComputerSelfPermission, delegate read access to a named group, and apply a policy with BackupDirectory = Active Directory, password encryption on, and encrypted password history (up to 12 entries). Encryption needs domain functional level 2016. History can get you into a server restored from an older backup, within limits: its local password is the one that was current at backup time, and Get-LapsADPassword -IncludeHistory shows earlier passwords with their update times. History is off by default, keeps at most 12 previous passwords (older ones drop off as rotations occur), and is readable only by the decryptor principal. If the restore point is older than the retained history, LAPS cannot supply its password, and you need a separately planned recovery process. On Windows Server 2025 devices with a Windows Server 2025 forest schema, LAPS also detects the rollback and rotates the password itself, provided the machine can still authenticate to the domain.

Why it matters

A local administrator account with the same password on every server is a single credential that unlocks the estate. An attacker who recovers it from one machine can reuse it everywhere; Microsoft's overview names pass-the-hash and lateral movement as the attacks Windows LAPS is meant to limit. A shared password also tends to be known by people who no longer work on the system, which overlaps with the checklist for removing a departed administrator's access.

LAPS changes the operational picture in two ways that people forget to plan for:

• The password you need is in the directory, not in a password vault or someone's head. If the directory is unavailable, or the reader lacks permission, nobody can sign in with the local account.
• Restores create a mismatch. A VM restored from last week's backup has last week's local password, while the directory holds this week's. Microsoft's concepts page calls this a "torn state" and gives a VM restored to an earlier snapshot as the example. Without planning, the restored server's local administrator becomes unusable until the next rotation, which may be weeks away.

How it works

Supported platforms

Microsoft lists Windows LAPS as available on:

• Windows Server 2025 and later; Windows Server 2022 and 2019 with the April 11 2023 update or later.
• Windows 11 23H2 and later; Windows 11 22H2/21H2 and Windows 10 with the April 11 2023 update or later (Windows 10 only where it still receives updates, for example through Extended Security Updates).

The legacy Microsoft LAPS product is deprecated as of Windows 11 23H2; newer Windows versions block its installer. Microsoft continues to support it on older Windows versions until their normal end of support.

Where the password can go

Microsoft Entra workplace-joined devices are not supported. This article concentrates on Active Directory backup, which is the usual case for servers.

Domain prerequisites

Clear-text storage relies on directory access control lists alone. Encrypted storage adds a decryptor principal (default: Domain Admins), and password history is supported only when encryption is enabled.

The processing cycle

A background task runs every hour (not a Task Scheduler task, and not configurable) and also responds to Group Policy change notifications. In the Active Directory case the device reads its own password expiration time from the directory each cycle; if expired, it generates a new password, writes it to the directory (event 10018), then sets it on the local account (event 10020). When a Windows LAPS policy is first applied, the device rotates the password immediately.

The managed account is protected against other changes: attempts to set its password outside LAPS are rejected and logged as event 10031. That includes a well-meaning administrator running net user during an incident.

Policy precedence

Windows LAPS reads policy from registry roots in this order and uses the first root that has at least one setting:

1. LAPS CSP (HKLM\Software\Microsoft\Policies\LAPS)
2. LAPS Group Policy (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\LAPS)
3. LAPS local configuration
4. Legacy Microsoft LAPS policy (HKLM\Software\Policies\Microsoft Services\AdmPwd), used only in emulation mode

Settings missing from the chosen root take their defaults; they are not merged from lower roots. A stray Intune profile or local registry setting can therefore override your Group Policy completely.

Settings that matter for servers

Default for ADPasswordEncryptionEnabled is not restated here; set it explicitly so the 10021 policy event shows what you intended.

Post-authentication actions are a server risk. With the default (3, after 24 hours), an administrator who signs in with the LAPS account to repair a server will be signed out and have their SMB sessions removed when the grace period ends. Value 5 restarts the device after a one-minute delay; value 11 also terminates remaining processes running as that account. On servers, decide deliberately; for most, value 1 (reset only) with an appropriate delay avoids an unplanned restart or a broken repair session.

Read-only checks

None of these was run for this article. Steps marked change in the decision section are configuration changes; everything in this section only reads.

Privileges and side effects:

• Get-LapsADPassword needs read permission on the computer object's LAPS attributes and, for encrypted passwords, membership of the decryptor principal. -AsPlainText prints the password on screen; use it only in a private session, and do not paste its output into tickets, chat or transcripts.
• Find-LapsADExtendedRights reads OU security descriptors; it changes nothing.
• Reading the LAPS event log needs local administrator rights on the device.
• Invoke-LapsPolicyProcessing is not read-only: it runs a processing cycle and can rotate the password if it has expired. It is listed under decision guidance.

Step 1: Confirm the device has Windows LAPS and which policy is in force

On the managed server, open Event Viewer at Applications and Services Logs > Microsoft > Windows > LAPS > Operational, or:

# Read-only. Most recent LAPS events on this device.
Get-WinEvent -LogName 'Microsoft-Windows-LAPS/Operational' -MaxEvents 50 |
    Select-Object TimeCreated, Id, LevelDisplayName, Message

Look for:

• 10003 / 10004 / 10005: cycle started / succeeded / failed (10005 carries an error code).
• 10021: the policy in force, including policy source (GPO or CSP), backup directory, account name, age, complexity, encryption, history size and post-authentication settings.
• 10018 then 10020: directory updated, then local account updated.
• 10031: something tried to change the managed password and was blocked.
• 10041 / 10042 / 10044: managed account used; grace period expired; reset and actions completed.

If the log channel does not exist, the device does not have Windows LAPS (missing April 2023 update or older OS).

Step 2: Check who can read passwords

# Read-only. Who holds "All extended rights" on the OU (can read confidential attributes, including LAPS).
Find-LapsADExtendedRights -Identity 'OU=Servers,DC=corp,DC=example'

Microsoft's guidance is that only trusted principals such as SYSTEM and Domain Admins should appear. Any other holder can read the confidential LAPS attributes in that OU; clear-text passwords are then exposed, and encrypted ones are exposed if that holder is also in the decryptor principal.

Step 3: Read the current entry and its history

# Read-only. Shows account, update time, expiry, source and decryption status.
Get-LapsADPassword -Identity 'APP01' -IncludeHistory

The Source field shows EncryptedPassword when encryption is active; DecryptionStatus and AuthorizedDecryptor show whether you can decrypt and who can. History entries appear only if ADEncryptedPasswordHistorySize was above 0 before the rotations you care about.

Step 4: Check the policy root on a device that behaves oddly

# Read-only. Which roots hold explicit LAPS policy values (an empty key shows none).
'HKLM:\Software\Microsoft\Policies\LAPS',
'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\LAPS',
'HKLM:\Software\Microsoft\Windows\CurrentVersion\LAPS\Config',
'HKLM:\Software\Policies\Microsoft Services\AdmPwd' |
    ForEach-Object {
        $names = if (Test-Path $_) { (Get-Item $_).Property } else { @() }
        [pscustomobject]@{ Root = $_; Values = ($names -join ', ') }
    }

A key that exists but holds no values does not count. The first root in this list with at least one explicitly defined setting wins. Treat this as an inventory: the effective-policy check is the "Policy source" and settings in event 10021, which wins if the two disagree.

Interpreting the results

Decision guidance

Deploying to Active Directory

1. Change: schema, once per forest. Update-LapsADSchema on a Windows Server 2019+ DC with Windows LAPS, or a server with the LAPS PowerShell module. Requires schema-change rights. Verification: the msLAPS attributes exist. Rollback: schema extensions cannot be removed; that is why this is a planned, once-only change.
2. Change: self-permission on each server OU. Set-LapsADComputerSelfPermission -Identity <OU>. Verification: 10018 events after the policy applies. Rollback: remove the inherited ACE from the OU.
3. Change: read and expire permissions. Set-LapsADReadPasswordPermission and Set-LapsADResetPasswordPermission for named groups. Domain Admins already have both. Rollback: remove the ACEs.
4. Change: policy GPO. BackupDirectory = Active Directory; encryption on; decryptor principal set to a dedicated group if Domain Admins is too broad; history size between 1 and 12; PostAuthenticationActions chosen for servers; a pilot OU first. If the Group Policy Central Store is used, copy the Windows LAPS templates into it.
5. Verification: on a pilot server, 10021 shows the intended values; 10018 and 10020 appear (the first application rotates immediately); Get-LapsADPassword from an authorised account returns DecryptionStatus: Success.
6. Rollback: unlink the GPO. The local password stays whatever LAPS last set, and the last value remains readable in the directory; record it before decommissioning LAPS on a device.

For templates, remember the immediate rotation on first application: a template that receives the policy during build will rotate, and every clone will then rotate again when it joins and picks up policy. That is expected behaviour, not a fault.

Migrating from legacy Microsoft LAPS

Microsoft describes two approaches:

• Immediate transition: disable the legacy policy and apply the Windows LAPS policy at the same time, ideally targeting the same account; monitor for success; remove the legacy software.
• Side-by-side, then transition: create a second local account for Windows LAPS (both products targeting the same account is not supported), apply Windows LAPS, confirm, then remove the legacy policy and the legacy software. Keep the new account that Windows LAPS manages; the account to retire is the one legacy LAPS managed, and only after you have confirmed nothing still signs in with it.

Legacy emulation mode lets Windows LAPS honour existing legacy GPOs, but stores passwords only in clear text, requires the legacy schema, and does not run if the legacy client-side extension is installed. It is a migration aid, not a destination. Any Windows LAPS policy present on a device always takes precedence over a legacy policy.

Verification: msLAPS-PasswordExpirationTime appears on the computer object; Get-LapsADPassword returns the new entry. Rollback: re-enable the legacy policy only if the legacy CSE is still installed and Windows LAPS policy is removed, so that only one product manages the account.

Recovering a VM restored from backup

The restored server's local password is the one that was current when the backup was taken.

1. Find the backup time of the restore point.
2. Run Get-LapsADPassword -Identity <server> -IncludeHistory from an authorised account. Confirm that the oldest entry is older than the backup time and that each entry shows DecryptionStatus: Success. If not, the password for that restore point is not available from LAPS; go to the unavailable-history branch below.
3. The candidate is the entry whose PasswordUpdateTime is the most recent one before the backup time. It is a candidate, not a certainty: if the server has been running since the restore, rollback detection (below) or a scheduled rotation may already have changed the local password, so also check the current entry and recent 10018/10020 events on the server if you can reach its event log.
4. Sign in on the console (vSphere or Hyper-V console, not over the network if the machine's domain trust is uncertain) with the candidate, then with the current entry if the candidate fails.
5. If the server can still authenticate to the domain, let LAPS rotate normally, or set the expiry to now with Set-LapsADPasswordExpirationTime (a change; requires expire permission) and run Invoke-LapsPolicyProcessing on the server. Verification: new 10018 and 10020 events; the current entry decrypts and works.
6. If the server cannot authenticate to the domain (trust relationship broken), LAPS cannot rotate or detect the rollback. Repair the secure channel first; see the article on member-server trust after restore below.

Unavailable-history branch. If no retained, decryptable entry covers the restore point, LAPS cannot reconstruct the password. Use the organisation's separately planned recovery process for that case, agreed before it is needed (for example a documented, access-controlled offline reset procedure for the server's operating system, or restoring a different, newer restore point). Record which restore points fall outside history, so the gap is known before the next restore test.

Automatic rollback detection. On Windows 11 24H2 and Windows Server 2025 devices, LAPS writes a GUID to msLAPS-CurrentPasswordVersion with each new password and compares it each cycle; a mismatch triggers an immediate rotation. This requires the Windows Server 2025 forest schema, which arrives when the first Windows Server 2025 DC is promoted (it is not added by Update-LapsADSchema), works only for Active Directory backup, and only when the machine can still authenticate. On older OS versions, history is your recovery path, within its retention.

All domain controllers unavailable

Retrieving LAPS passwords normally needs at least one DC. Querying a mounted directory and decrypting its passwords are different things:

• Querying a mounted backup. Microsoft documents mounting an Active Directory backup database with dsamain.exe and querying it with Get-LapsADPassword -Port. dsamain.exe is not installed by default (it is part of the AD LDS feature). Microsoft's -Port example returns a password stored in clear text.
• Decrypting encrypted or DSRM passwords with no DC. Microsoft's deployment page says that on Windows Insider build 27695 and later, -Port together with -RecoveryMode recovers passwords with no need to contact a domain controller. The cmdlet reference describes -RecoveryMode in a different context: you must be signed in locally as a Domain Administrator on a writable domain controller. The sources therefore do not establish a released-build path for decrypting encrypted or DSRM passwords when every DC is offline.

Until you have confirmed the exact tool build and prerequisites on your own systems and rehearsed the procedure in a lab, treat offline encrypted recovery as unverified. Keep a separately secured recovery plan for the all-DCs-down case, and back up DCs regularly.

What not to do

• Do not install legacy LAPS on new OS versions or run both products against the same account.
• Do not grant "All extended rights" on server OUs to operator groups; it exposes every LAPS password.
• Do not grant managed devices decrypt rights, including on their own passwords; Microsoft recommends against it.
• Do not reset the managed password manually during an incident; LAPS rejects it (10031). Use Reset-LapsPassword locally or set the expiry.
• Do not leave history at 0 if you restore servers from backups; history cannot be created retrospectively.
• Do not post -AsPlainText output into tickets, chat or shared notes.
• Do not set PostAuthenticationActions to 5 or 11 on production servers without a change decision; they restart the server or end processes.

Limitations

• This article covers Active Directory backup. Microsoft Entra backup has a seven-day minimum password age, the AD-only settings (encryption, history, DSRM backup, expiration protection) do not apply, and rollback detection is not supported.
• Rollback detection needs Windows Server 2025 / Windows 11 24H2 devices and the Windows Server 2025 forest schema.
• -RecoveryMode was documented for an Insider build at the time of writing, and the two Microsoft pages describe it in different contexts; offline decryption of encrypted or DSRM passwords is unverified here.
• Decryptor principal cannot be changed for passwords already encrypted; plan the group before enabling encryption.
• Automatic Account Management settings require Windows 11 24H2 or Windows Server 2025 and are not covered here.
• No command here was run for this article.

Acceptance checklist

• [ ] Every server OS has Windows LAPS (April 2023 update or later, or a newer OS).
• [ ] Domain functional level 2016 or later confirmed before enabling encryption.
• [ ] Schema extended once; self-permission set on each server OU.
• [ ] Read and decrypt permissions held by named groups; Find-LapsADExtendedRights shows only trusted principals.
• [ ] Policy explicitly sets encryption, history size (1–12), and post-authentication actions suitable for servers.
• [ ] 10021 on a pilot server shows the intended values; 10018 and 10020 present.
• [ ] Legacy LAPS migration approach chosen; no device managed by both.
• [ ] Restore runbook includes Get-LapsADPassword -IncludeHistory and the backup-time comparison.
• [ ] DC-loss recovery proven in a lab: either decryption of encrypted or DSRM passwords from a mounted backup with no DC (dsamain.exe, -Port with -RecoveryMode) on the exact build and prerequisites you will use, or the separately secured recovery plan for the all-DCs-down case rehearsed end to end. A successful -Port query on its own does not close this item.

References

All accessed 2 November 2026.

• Microsoft Learn, "Windows LAPS overview": https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview
• Microsoft Learn, "Key concepts in Windows LAPS": https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-concepts-overview
• Microsoft Learn, "Get started with Windows LAPS and Windows Server Active Directory": https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-scenarios-windows-server-active-directory
• Microsoft Learn, "Configure policy settings for Windows LAPS": https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-policy-settings
• Microsoft Learn, "Use Windows LAPS event logs": https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log
• Microsoft Learn, "Migrate to Windows LAPS from legacy LAPS": https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-scenarios-migration
• Microsoft Learn, "Get started with Windows LAPS in legacy Microsoft LAPS emulation mode": https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-scenarios-legacy
• Microsoft Learn, "Get-LapsADPassword": https://learn.microsoft.com/en-us/powershell/module/laps/get-lapsadpassword

Related articles

• Group Policy Not Applying: gpresult, Events and SYSVOL
• Domain Controllers on VMware: Snapshots and Restores

• How to build and validate Windows Server templates for VMware

• "The Trust Relationship Failed" After a Member Server Restore: Prove the Secure Channel and Repair It in Place

• Revoke a Departed Administrator's Access Across a Hosted Estate

Learning notes

1. Windows LAPS is built into supported Windows; legacy Microsoft LAPS is deprecated and blocked on newer versions.
2. Encryption needs DFL 2016, and password history needs encryption; set both before you need them.
3. Policy comes from the first registry root with at least one explicitly defined setting, so a CSP profile can silently replace your GPO; event 10021 shows which one is in force.
4. A restored VM has the password current at backup time; -IncludeHistory plus the backup timestamp gives a candidate, but only if retained, decryptable history covers that time (at most 12 entries). Plan a separate recovery for older restore points.
5. Rollback detection on Server 2025 needs the 2025 forest schema and a working domain trust; otherwise retained history, or the separately planned recovery process, is the path.