{"id":237115,"date":"2023-07-24T07:29:10","date_gmt":"2023-07-24T07:29:10","guid":{"rendered":"https:\/\/consulting.lm-ag.de\/?p=237115"},"modified":"2025-09-25T14:40:42","modified_gmt":"2025-09-25T12:40:42","slug":"windows-laps","status":"publish","type":"post","link":"https:\/\/www.lm-ag.de\/en\/windows-laps\/","title":{"rendered":"Windows LAPS - local administrators firmly in control"},"content":{"rendered":"
\n
\n
\n

Improved security for local administrator accounts<\/h1>\n<\/div><\/div>\n\n

Administrative rights on company computers can be handy, but they often come with insecure and repetitive passwords. In this blog post, we talk about a solution that helps to improve the security of local administrator accounts: Windows LAPS<\/strong>.<\/p>\n

LAPS stands for Local Administrator Password Solution<\/strong>. Almost 10 years ago, Microsoft developed the \"LAPS\" tool, which automatically and regularly changes local passwords and stores them centrally.<\/p>\n<\/div><\/div>\n<\/div>\n\n

\n

About the author<\/h4>\n<\/div><\/div>\n\n
<\/span><\/div>\n\n

Patrick Jochmann<\/h4>\n

Modern Workplace Consultant<\/p>\n

\"\"<\/a>\u2003\"\"<\/a>\u2003\"\"<\/a><\/p>\n<\/div><\/div>\n<\/div>\n<\/div>\n\n

\n
\n

About the author<\/h4>\n<\/div><\/div>\n\n
<\/span><\/div>\n\n

Patrick Jochmann<\/h4>\n

Modern Workplace Consultant<\/p>\n

\"\"<\/a>\u2003\"\"<\/a>\u2003\"\"<\/a><\/p>\n<\/div><\/div>\n\n

<\/div><\/div>\n\n

Improved security for local administrator accounts<\/h2>\n<\/div><\/div>\n\n

Administrative rights on company computers can be handy, but they often come with insecure and repetitive passwords. In this blog post, we talk about a solution that helps to improve the security of local administrator accounts: Windows LAPS.<\/strong><\/p>\n

LAPS stands for Local Administrator Password Solution<\/strong>Almost 10 years ago, Microsoft developed the \"LAPS\" tool, which automatically and regularly changes local passwords and stores them centrally.<\/p>\n<\/div><\/div>\n<\/div>\n<\/div>\n\n

\n
\n

What advantages does LAPS offer?<\/h3>\n<\/div><\/div>\n<\/div>\n<\/div>\n\n
\n
\n

\"\"<\/p>\n

Unique passwords<\/h5>\n

Each local administrator of a computer has their own cryptic admin password, which prevents the use of default passwords.<\/p>\n<\/div><\/div>\n<\/div>\n\n

\n

\"\"<\/p>\n

Regular rotation<\/h5>\n

The passwords are changed automatically at predefined intervals.<\/p>\n<\/div><\/div>\n<\/div>\n\n

\n

\"\"<\/p>\n

Limited impact<\/h5>\n

If a password is compromised, not all systems are directly at risk.<\/p>\n<\/div><\/div>\n<\/div>\n<\/div>\n\n

\n
\n

What's new?<\/h3>\n<\/div><\/div>\n\n

Why are we writing about LAPS now? Microsoft recently released the new Windows LAPS<\/strong> the successor to the classic LAPS solution. Windows LAPS now offers various Advantages<\/strong>that administrators have been waiting for a long time:<\/p>\n<\/div><\/div>\n<\/div>\n<\/div>\n\n

\n
\n

\"Icon<\/p>\n

Direct integration<\/h5>\n

The technology is now integrated directly into the computer's operating system, which means that separate software no longer needs to be rolled out.<\/p>\n<\/div><\/div>\n<\/div>\n\n

\n

\"Icon<\/p>\n

Extended configuration options<\/h5>\n

Windows LAPS offers new functions that optimise the use and security of the solution.<\/p>\n<\/div><\/div>\n<\/div>\n<\/div>\n\n

\n
\n

The biggest advantage of Windows LAPS is still the Centralised storage of passwords<\/strong>but now new<\/strong>: Also in the Azure AD or Intune<\/strong>. No more dependencies on onPrem systems!<\/p>\n

To emphasise the importance of Windows LAPS in practice<\/strong> To illustrate this, let us consider the following scenario:
\nImagine an organisation has a considerable number of computers on which local administrator accounts are set up with identical and weak passwords. In the worst-case scenario, the employees also have local administrator rights on their workstation computers due to their duties. One day, an employee's company laptop is stolen or an attacker gains access to the device via malware, for example.<\/p>\n<\/div><\/div>\n<\/div>\n<\/div>\n\n

\n
\n

Firstly, the attacker will try to find out the access data of the local administrator. Immediately afterwards, he will try to access other computers in the network with these credentials. It will not be long before the access data works on a computer on which IT administrators may be working or from which important servers are accessed. In technical jargon, this is called \"Lateral Movement\"<\/strong>This means gaining access to more in-depth systems with initially not so important access data.<\/p>\n

If IT were to notice this, you would now be faced with having to manually change the passwords on all devices. And what happens to the systems that are currently inaccessible, e.g. in the home office? This process would be time-consuming, error-prone and could lead to significant operational disruptions.<\/p>\n<\/div><\/div>\n<\/div>\n\n

\n
\"Windows<\/span><\/div>\n<\/div>\n<\/div>\n\n
\n
\n

With Windows LAPS, the scenario would be very different. The Passwords would be unique, they rotate regularly and are more cryptic<\/strong> than the very simple access data that is often used. The centralised storage of passwords in Azure AD and the associated device management via Intune enables the organisation to change the password for the device concerned. to be changed immediately<\/strong> and prevent the attacker from accessing other systems. At the same time, the remaining computers would continue to retain their individual, changing passwords, which is a High security<\/strong> of the environment<\/p>\n

This example shows how Windows LAPS can help to minimise potential security risks and limit the damage in the event of a security incident<\/strong>. By implementing LAPS, organisations can improve the management of their local administrator accounts and ensure a higher level of security and control over their IT infrastructure.<\/p>\n<\/div><\/div>\n<\/div>\n<\/div>\n<\/div>\n\n

\n
\n
\n

Do you have any questions?<\/h3>\n

If you are not yet familiar with LAPS or have not yet implemented it, or if you would like to learn more about the benefits of the new solution, we will be happy to help you introduce Windows LAPS.
\nContact us and benefit from increased security with minimum effort.<\/p>\n<\/div><\/div>\n\n

Make an appointment directly<\/a><\/div>\n<\/div>\n\n
\n
\n\n