What Local Administrator Password Solution Does and How It Works

Local Administrator Password Solution is a tool that lets organizations manage the built-in administrator account on Windows computers without storing a single shared password

Local Administrator Password Solution (LAPS) is a Windows security feature that automatically generates and rotates a unique, complex password for the local administrator account on each computer in a network. Instead of all machines sharing one administrator password — which creates a security risk if that password leaks — LAPS gives every computer its own password and stores it in Active Directory, where only authorized people can retrieve it.

If you work in an organization with multiple computers, LAPS prevents the scenario where one leaked password compromises every machine. It also creates an audit trail: the system records who accessed each password and when, so your IT team can track administrator activity across the network.

Key Takeaways

LAPS generates a different, complex administrator password for each computer instead of using one shared password across all machines.
The passwords are stored in Active Directory and rotate automatically on a schedule you set, typically every 30 days.
Only people with permission to read the password in Active Directory can access it, and the system logs who retrieved it and when.
LAPS is built into Windows 10, Windows 11, and Windows Server 2016 and later, so organizations do not need to buy separate software.
If a computer is not connected to Active Directory or your organization does not use it, LAPS cannot be used on that machine.

How LAPS generates and stores passwords

When LAPS is turned on for a computer, it creates a random administrator password that meets complexity rules: at least 14 characters, uppercase and lowercase letters, numbers, and special characters. The password is generated locally on the computer itself, not sent over the network where it could be intercepted.

Once generated, the password is sent to Active Directory and stored in an encrypted field attached to that computer's account. The local administrator account on the computer is updated to use this new password. The next time the rotation schedule runs — usually 30 days later — the process repeats: a new password is generated, stored, and the account is updated.

Because the password lives in Active Directory rather than on the computer or in a shared document, it is protected by the same access controls as any other directory data. Your IT team can grant permission to retrieve the password only to specific people or groups, and deny it to everyone else.

Who can see the password and how they retrieve it

Your IT administrator decides which people or groups can view the LAPS password for each computer. This is typically IT support staff who need to troubleshoot machines, but it could also include security teams or managers. Someone without permission cannot see the password, even if they have physical access to the computer.

To retrieve a password, an authorized person opens Active Directory Users and Computers (or a similar directory tool), finds the computer account, and views the password property. Some organizations use a web portal or custom process that makes this easier, but the underlying process is the same: read the password from Active Directory.

Every time someone retrieves a password, the system records the action: who retrieved it, which computer, and when. This audit log helps organizations detect unusual access patterns, such as someone repeatedly pulling passwords for machines they do not normally support.

Why organizations use LAPS instead of a shared password

A shared administrator password — one password used on every computer in the organization — is simpler to manage but creates a single point of failure. If that password is written down, shared in email, or discovered by someone who should not have it, every computer is compromised. An attacker with the shared password can move freely across the network, access sensitive data, and install malware on any machine.

LAPS eliminates this risk by ensuring that even if one password is compromised, only one computer is affected. An attacker who steals the administrator password for one machine cannot use it to access any other computer. The organization can also change the password on just that machine without disrupting the others.

LAPS also reduces the number of people who need to know the password. With a shared password, everyone from IT support to contractors might have it. With LAPS, only people with Active Directory permission can retrieve it, and the audit trail shows exactly who accessed it.

Requirements for using LAPS

Your organization must have Active Directory set up and running, because LAPS stores passwords there. Computers must be joined to the Active Directory domain and able to communicate with a domain controller. If a computer is not connected to Active Directory — such as a standalone machine or one on a different network — LAPS cannot manage its administrator password.

Windows 10, Windows 11, Windows Server 2016, and later versions have LAPS built in. Older versions of Windows do not support it. Your IT team must also configure Group Policy to turn LAPS on for the computers where you want it, and set the password rotation schedule and complexity rules.

What happens when a computer is offline

If a computer is offline when the password rotation is scheduled, LAPS will attempt the rotation the next time the computer connects to the network and communicates with a domain controller. The system does not skip the rotation; it straightforward delays it until the computer is reachable again.

If a computer remains offline for an extended period, the administrator password on that machine will not change until it reconnects. This is why organizations sometimes set a maximum age for passwords: if a password has not been rotated in 60 days, for example, the system flags it as overdue and IT staff know to investigate why the computer has not checked in.

Common confusion about LAPS and what it does not do

LAPS manages only the local administrator account on each computer — the built-in account that exists on every Windows machine. It does not manage user passwords, domain administrator accounts, or service accounts. If you need to manage passwords for those accounts, you would use a different tool, such as a password manager or identity management system.

LAPS also does not prevent someone from using the administrator account once they have the password. It only controls who can retrieve the password from Active Directory and creates a record of who retrieved it. If someone has the password and logs in, LAPS does not stop them or alert you in real time — that is the job of other security tools like endpoint detection or login auditing.

Frequently Asked Questions

Can I use LAPS if my organization does not have Active Directory?

No. LAPS requires Active Directory to store and manage passwords. If your organization does not use Active Directory, you would need to set it up first, or use a different password management solution designed for standalone computers or non-domain environments.

What happens to the password if someone leaves the organization?

The password itself does not change automatically when someone leaves. However, your IT team can remove that person's permission to retrieve passwords from Active Directory when ready, preventing them from accessing any new passwords. The old password they may have retrieved is still valid until the next rotation, so organizations often rotate passwords when ready after an employee with access departs.

Can I retrieve a LAPS password if I forgot the administrator password on my computer?

Yes, if you have permission to retrieve it from Active Directory. You would contact someone with access to the directory, retrieve the current password, and use it to log in. This is one reason organizations use LAPS: it provides a recovery path when the local administrator password is lost or forgotten.

Does LAPS work on computers outside the office network?

LAPS requires the computer to connect to a domain controller to retrieve and update the password. If a computer is remote but can reach the domain controller over VPN or another find connection, LAPS will work. If the computer cannot reach the domain controller, password rotation will not occur until it reconnects.

Can I set different password rules for different computers?

Yes. Your IT team can use Group Policy to explore different LAPS settings to different groups of computers. For example, servers might require a 20-character password that rotates every 14 days, while workstations might use 14 characters and rotate every 30 days. Each computer group can have its own rules.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.