Boost Endpoint Security by Implementing Microsoft LAPS

Today, we will be implementing Microsoft LAPS, a powerful security tool that helps to secure your endpoints by managing local admin passwords. With Microsoft LAPS, you can ensure that all local admin passwords are unique and complex, and that they are changed at regular intervals. This helps to reduce the risk of unauthorized access to your systems and data.

Furthermore, I will also demonstrate the logging feature of Microsoft LAPS. With logging, you can keep track of password usage and detect any potential security breaches. By monitoring the audit logs, you can quickly identify any suspicious activity and take immediate action to prevent any damage to your systems.

Overall, implementing Microsoft LAPS is an essential step towards securing your endpoint and protecting your sensitive data. It is a powerful and easy-to-use tool that can significantly reduce the risks of cyber-attacks and unauthorized access.

Please note the minimum requirements for LAPS:
* For Windows 10 minimal 20H2 with April updates
* For Windows 11 minimal 21H2 with April updates

LAPS configuration

1. Open https://portal.azure.com
2. Open Azure Active Directory and open Devices
3. Choose on the left-side of the screen Device Settings
4. Enable Azure AD Local Administrator Password Solution (LAPS)
   
5. Open https://intune.microsoft.com
6. Open Devices – Endpoint Security – Account Protection and create new policy
   
7. Platform Windows 10 and later Profile Local admin password solution (LAPS)
   
8. Fill in a descriptive name such as “Baseline – Security – Enable LAPS For Built-in Administrator“
9. Please add the settings as shown in the image below.
   
10. Assign the policy

Enable Built-in Administrator Account

In addition to configuring the LAPS profile, we also need to ensure that the local administrator account is enabled. By default, this account is disabled on AAD-joined devices.

1. Create a new configuration profile
2. Platfrom Windows 10 and later – Templates – Custom
   
3. Fill in a descriptive name such as “Baseline – Security – Enable Built-in Administrator“
4. Name: Enable Local Administrator
   OMA URI: ./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus
   Data type: Integer
   Value: 1
   
5. Assign the policy

Where to find your LAPS password?

1. Open https://intune.microsoft.com
2. Open Devices – Choose a device – Open Local Admin Password
   
   
3. LAPS password is shown here

LAPS event logging

At the endpoint, you can view all events related to Microsoft LAPS in the event log.

1. Open Event Viewer
2. Open Microsoft – Windows – LAPS
   

LAPS audit logging

Now let’s take a look at what the audit log looks like from Intune’s perspective

1. Open https://intune.microsoft.com
2. Open Tenant administration – Audit logs
   
3. Select the activity for more details
   

Thank you for taking the time to read my blog. Kindly share it with others if you find it helpful!