Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Quietly Mandates Enterprise Local Admin Password Solution
Transcript
- Lucas: Microsoft has added another quiet mandate to Windows 11. This time it's about local admin passwords. Luna: You mean the built-in admin account that every Windows machine has? That password? Lucas: Exactly. For years, IT departments have either set a common local admin password across all machines, which is a security nightmare if one machine gets compromised, or they've used a tool like Microsoft's LAPS—Local Administrator Password Solution—to rotate that password automatically and store it securely in Active Directory. Luna: And now LAPS is being mandated? Lucas: Starting with the Windows 11 2025 feature update, which began rolling out in April, any device joined to a domain—whether on-premises Active Directory or Azure AD—must have a local admin password management solution in place. You can use Microsoft's built-in LAPS or a third-party equivalent, but you can't leave that password static anymore. Luna: So what happens if an IT admin ignores this? Does the machine refuse to boot? Lucas: No, nothing that dramatic. What happens is that security policies will block the machine from connecting to the domain if LAPS isn't configured. So the device becomes isolated—it can't authenticate with the network, can't receive Group Policy updates, can't apply software updates from WSUS. It's effectively stranded until the admin fixes the LAPS configuration. Luna: That's a pretty strong enforcement mechanism. I remember when Microsoft made TPM 2.0 mandatory for Windows 11—that caused a lot of hardware upgrades. This seems more like a software policy change, but still significant. Lucas: Right. TPM was a hardware requirement that left a lot of perfectly good PCs behind. This is purely a configuration requirement. Any machine that can run Windows 11 can implement LAPS. It's been built into the OS since Windows 10 version 1607, but it was an optional feature you had to install separately. Now it's baked in and enforced. Luna: Let's talk about why Microsoft is doing this. The security rationale is pretty clear. Shared local admin passwords were a huge attack vector in ransomware incidents. If an attacker gets one machine, they can use that same password to pivot laterally across the entire domain. Lucas: Exactly. The infamous NotPetya outbreak in 2017 spread partly through stolen local admin credentials. And even today, penetration testers routinely find organizations where every workstation has the same local admin password, often something like 'Password123' or the company name. Mandating LAPS closes that gap entirely. Luna: So what does the actual implementation look like? If I'm an IT admin and I haven't set up LAPS yet, what do I need to do? Lucas: First, you need to extend your Active Directory schema to support LAPS attributes. That's a one-time operation that requires Schema Admin rights. Then you deploy the LAPS client—which, as I mentioned, is now built into Windows 11, but for existing machines you might need to enable it via Group Policy. After that, you configure a Group Policy Object that defines which security groups can read the local admin password from AD. Luna: And the password gets rotated on a schedule you set? Lucas: Yes. You can set the password to rotate every 30 days, or every time the machine reboots, or even after the password has been used. And the password is stored encrypted in a confidential attribute in Active Directory, so only authorized users—like help desk staff—can retrieve it. Luna: What about Azure AD joined devices? Does LAPS work with those too? Lucas: Microsoft introduced Azure AD LAPS in 2023, which stores the password in Azure AD instead of on-prem AD. For hybrid joined devices, you can use either. But for pure cloud-joined devices, you need Azure AD LAPS. The enforcement applies to both scenarios. Luna: There's also a third-party ecosystem for this. Tools like CyberArk, Thycotic, and ManageEngine have offered local admin password management for years. Does Microsoft's mandate allow those? Lucas: Yes. The requirement is that you have a solution in place—it doesn't have to be Microsoft's. However, the built-in LAPS is free and tightly integrated, so most organizations will probably use it. But if you already have a third-party solution that meets the same security requirements, you can keep it. Luna: One thing I've heard from IT admins is that LAPS can be a bit tricky to deploy at scale, especially in large environments with multiple forests. Lucas: That's a fair point. The schema extension has to be done once per forest, and you need to ensure that delegation is set up correctly. But Microsoft has improved the deployment experience significantly. There's a Group Policy template that handles most of the configuration, and the LAPS UI in Active Directory Users and Computers makes it easy to retrieve passwords. Luna: And there's also the new Windows LAPS, which is the modern version that supports both on-prem and Azure AD. That's the one built into Windows 11. Lucas: Right. Windows LAPS is the successor to the legacy LAPS tool. It supports more features, like password encryption using your organization's public key, and it works with Azure AD without needing an on-prem domain controller. It's actually a significant improvement. Luna: I want to go back to the enforcement timeline. When does this actually take effect? Is it already in place? Lucas: The 2025 feature update started deploying in April. But Microsoft has given a grace period—domain-joined devices that upgrade to that version won't be blocked immediately. Instead, they'll get a warning in the Settings app and in event logs. The enforcement will kick in with the first cumulative update after the feature update, so roughly 30 to 60 days after the upgrade. Luna: So if you haven't upgraded to the 2025 feature update yet, you have some time. But eventually, all Windows 11 devices will need LAPS configured. Lucas: Correct. And since Microsoft is pushing the feature update aggressively through Windows Update for Business, most enterprise devices will get it within the next few months. Luna: Now, is there any way to bypass this requirement? For example, if you disable the local admin account entirely, do you still need LAPS? Lucas: That's a good question. If you disable the built-in Administrator account and don't create any other local admin accounts, then technically you don't have a local admin password to manage. But Microsoft's policy checks for the presence of a local admin account with a password. If you have one, it must be managed by LAPS. If you don't have any local admin accounts, you should be fine. However, many applications and scripts still rely on a local admin account, so completely disabling it isn't always practical. Luna: What about using a Microsoft account to sign in? That bypasses the local account entirely. Lucas: That's true for consumer devices, but in enterprise environments, most devices are domain-joined and use Active Directory or Azure AD accounts. The local admin account is still there, even if you rarely use it. So LAPS is still required. Luna: There's also the scenario where you have a kiosk or shared workstation that needs a local admin for maintenance. LAPS handles that well because the password changes automatically, so you don't have to worry about someone using an old password. Lucas: Exactly. And for help desk scenarios, the technician can request the current password from Active Directory, use it, and the next rotation will invalidate it. It's much more secure than having a shared password that never changes. Luna: I want to pivot slightly to the broader pattern. Microsoft has been quietly adding these enterprise mandates for a few years now—TPM, Secure Boot, BitLocker recovery key escrow, virtualization-based security, and now LAPS. What's the endgame? Lucas: It's clearly a Zero Trust push. Microsoft wants every device to have hardware root of trust, disk encryption, credential isolation, and local admin password management. They're essentially forcing enterprises to adopt security best practices that many have been ignoring for years. And by making them mandatory in the OS, they reduce the attack surface across the entire Windows ecosystem. Luna: It also simplifies support for Microsoft. If every device has these features enabled, troubleshooting security incidents becomes more predictable. Lucas: Sure, and it aligns with their own security recommendations. Microsoft's own Digital Crimes Unit has seen too many breaches that started with a compromised local admin password. Mandating LAPS is a relatively low-cost way to eliminate an entire class of attacks. Luna: Let's talk about the cost. For organizations that already have a third-party solution, there's no additional cost. But for those that don't, LAPS is free—it's included in Windows. So the main cost is the administrative time to deploy it. Lucas: Right. And that time can be significant for a large enterprise. You need to plan the schema extension, test the Group Policy, train help desk staff on how to retrieve passwords, and ensure that emergency access procedures are updated. But once it's in place, it's largely self-maintaining. Luna: We've been talking about this as if it's a new requirement, but honestly, if today's tech conversation gave you something usable, consider that it's worth a coffee to keep the show ad-free. If today's Windows 11 LAPS breakdown saved you time figuring out the mandate, buy me a coffee dot com slash fexingo is the place. Just a small thing, but it keeps the podcast independent. Lucas: Yeah, we don't run ads, so listener support is what keeps us going. And we appreciate every single contribution. Luna: Back to LAPS—one thing we haven't covered is how this affects small businesses. If you're a small IT shop with five machines, is LAPS still mandatory? Lucas: Yes, if those machines are domain-joined. But for small businesses, Microsoft has made it easier. The Windows 11 2025 feature update includes a simplified LAPS setup wizard that walks you through the configuration. You don't need to be a PowerShell expert anymore. Luna: Good to know. So there's really no excuse not to implement it. Lucas: I'd say the biggest barrier is legacy apps that require a known local admin password. Some older software installations or scripts hardcode the password. Those will break when LAPS rotates the password. So IT admins need to identify those dependencies and either update the scripts to use the LAPS API or create a service account with the necessary privileges. Luna: That's a real pain point. I've seen organizations hold off on security updates because of one legacy app that won't work with LAPS. Lucas: And that's exactly the kind of risk Microsoft is trying to eliminate. They'd rather force the issue now than wait for every legacy app to be updated. It's a tough love approach, but it's effective. Luna: One more thing—what about disaster recovery scenarios? If the domain controller is down, you can't retrieve the LAPS password. How do you log in locally? Lucas: That's an important edge case. Microsoft recommends having a break-glass procedure, such as storing emergency local admin passwords in a secure offline location, like a safe. Or you can use the local admin password recovery feature in Windows Recovery Environment, which allows a technician with physical access to reset the password using a recovery key. Luna: So it's not a perfect solution, but it's a huge improvement over the status quo. Lucas: Absolutely. And as with any security control, you have to balance security with operational resilience. The key is to plan for the failure scenarios. Luna: I think we've covered the essentials. Any final thoughts on LAPS? Lucas: Just that if you're an IT admin and you haven't started testing LAPS in your environment, now is the time. The 2025 feature update is rolling out, and enforcement is coming within months. Don't wait until devices start getting blocked. Luna: Sound advice. And for listeners who want to dive deeper, Microsoft has a detailed deployment guide on learn.microsoft.com. Lucas: We'll link to that in the show notes. Thanks for listening, and we'll catch you next time.