5 Essential Steps for Configuring Windows LAPS for Maximum Security
Updated: Jan 12
Configuring Windows Local Administrator Password Solution (LAPS) in Account Protection through Microsoft Intune involves several steps to ensure that your local administrator passwords are managed and secured. Here’s a step-by-step guide to help you set it up:
Prerequisites:
Azure AD Premium P1 or P2: Ensure your organization has the necessary licenses.
Windows 10 version 20H2 or later: Confirm that the devices are running a compatible version of Windows.
Intune Admin Role: Ensure you have the necessary permissions in Intune.
Step-by-Step Configuration:
1. Enable LAPS in Azure AD:
Sign in to the Azure portal.
Navigate to Azure Active Directory > Devices > Device Settings.
Set the Local administrator password solution (LAPS) to Enabled.
2. Create a Configuration Profile in Intune:
Sign in to the Microsoft Endpoint Manager admin center.
Go to Devices > Configuration profiles > Create profile.
Select Windows 10 and later for the platform and Templates for the profile type.
Choose Account protection from the list of templates.
3. Configure LAPS Settings:
Name your profile (e.g., “LAPS Configuration”) and provide a description.
In the Configuration settings tab, configure the following:
Backup directory: Azure AD.
Password age (days): Set the number of days before the password is reset.
Password complexity: Define the complexity requirements (length, special characters, etc.).
Administrator account name: Specify the local administrator account name if it’s different from the default (usually “Administrator”).
Do not allow password expiration: Decide if you want to prevent the password from expiring.
Do not allow password change: Decide if you want to prevent manual password changes.
4. Assign the Profile to Devices:
In the Assignments tab, select the groups or devices to which you want to apply the LAPS configuration.
Review the settings and click Create.
5. Monitor and Verify:
After deployment, monitor the configuration status in the Intune admin center under Devices > Configuration profiles.
Ensure that the profile is successfully applied to the targeted devices.
You can verify LAPS functionality by checking the local administrator password on a managed device. Use the Microsoft Graph API or Azure AD portal to retrieve the password.
Additional Tips:
Audit and Compliance: Regularly audit and ensure compliance with your organization’s security policies.
Documentation and Training: Provide documentation and training to IT staff on how to manage and retrieve LAPS passwords.
Security Best Practices: Use strong password policies and regular updates to maintain security.
Resources:
By following these steps, you can effectively configure Windows LAPS in Account Protection through Intune, ensuring that local administrator passwords are securely managed.
Comments