Windows Local Administrator Password Solution (Windows LAPS)

Question 1

Can Windows LAPS create local admin accounts based on the administrator account name that’s configured using LAPS policy?

Answer 1

No
Windows LAPS can only manage accounts that already exist on the device.

Question 2

What are the 2 licensing requirements ?

Answer 2

• Intune subscription
  Microsoft Entra ID : Free version minimum

Question 3

Which 2 types of directories can LAPS configure?

Answer 3

• Microsoft Entra ID (cloud)
• On-premises Active Directory
  LAPS on Windows devices can be configured to use one directory type or the other, but not both.

Question 4

What are the supported join types?

Answer 4

• Microsoft Entra joined or Microsoft Entra hybrid joined devices only. Microsoft Entra registered devices and workgroup joined devices aren’t supported.

Question 5

Before creating a LAPS policy in Intune, what do you do?

Answer 5

Ensure that you have enabled LAPS in Microsoft Entra

Question 6

How to enable LAPS in MS Entra?

Answer 6

Step 1 : Sign in to the Microsoft Entra admin center as at least a Cloud Device Administrator.

Step 2 : Browse to Entra ID > Devices > Overview > Device settings

Step 3 : Select Yes for the Enable Local Administrator Password Solution (LAPS) setting, then select Save.

Configure a client-side policy and set the BackUpDirectory to be Microsoft Entra ID

Question 7

Describe the 7 steps to create a LAPS policy

Answer 7

Step 1 : Sign in to the Microsoft Intune admin center and go to Endpoint security > Account protection, and then select Create Policy.

Step 2 : Set the Platform to Windows 10 and later, Profile to Local admin password solution (Windows LAPS), and then select Create.

Step 3 : On Basics, enter name+description

Step 4 : On Configuration settings, Configure a choice for Backup Directory to define the type of Directory to use to back up the local admin account. You can also choose not to back up an account and password. The type of Directory also determines which additional settings are available in this policy.

Step 5 : review and configure the available settings: pwd lenght post authentication actions, post authentication delay

Step 6 : Set the Scope tags

Step 7 : Assignments, select the groups to receive this policy. MS recommends assigning LAPS policy to device groups