Windows LAPS With Intune: Local Admin Password Guide for Texas SMBs 2026

Many small businesses image machines from one template or set the same built-in administrator password during setup so the help desk can get in. That password then lives in a spreadsheet, a ticket, or someone's memory for years. Industry reporting consistently shows that credential reuse and lateral movement are how a minor compromise turns into a ransomware event.

The pattern is simple. An attacker lands on one laptop through a phishing link or an infostealer infection, dumps the local admin hash, and replays it against every other machine that shares it. Unique passwords per device break that chain, which is why LAPS is a core control in any least privilege program.

Windows LAPS is built into current Windows 11 and Windows Server builds, so there is no separate agent to install. It does four jobs:

• Generates a long random password for a managed local administrator account on each device.
• Rotates that password on a schedule you choose, and again after it is used.
• Stores the current password in Microsoft Entra ID or on-premises Active Directory, encrypted, instead of on the device or in a spreadsheet.
• Controls who can read it, with every retrieval logged for audit.

Technicians retrieve a password only when they need it. After the fix, the password rotates and the old one is worthless.

If your devices are managed in Intune, the rollout takes an afternoon. Pair it with your existing Intune device compliance policies so unmanaged machines are not left behind.

1. Enable LAPS in Entra ID. In the Entra admin center, open device settings and turn on the option to enable Microsoft Entra Local Administrator Password Solution.
2. Create an account protection policy. In Intune, add an Endpoint security policy for Account protection and choose the LAPS profile.
3. Set the backup target. Choose Entra ID for cloud-joined and hybrid devices. Only use Active Directory if your devices are domain-joined and you still run domain controllers.
4. Name the managed account. Either let LAPS manage the built-in Administrator account or create a dedicated account such as a technician login, which is the cleaner option.
5. Set length and age. A 14 to 20 character password with a rotation age of 30 days or less is a sensible starting point for most offices.
6. Configure post-authentication actions. Rotate the password and sign the account out shortly after a technician uses it.
7. Assign to a pilot group. Test on a handful of devices, retrieve a password, confirm rotation, then roll out to everyone.

LAPS only helps if the vault itself is protected. Limit password reads to a small support role rather than every administrator, and require MFA for those accounts through Entra Conditional Access policies. Review the audit log monthly. A technician who retrieves ten passwords on a Sunday night should prompt a question.

For admins who work with elevated privileges all day, consider moving to passkeys and passwordless sign-in so the accounts guarding the LAPS vault are phishing resistant.

• Leaving the old shared password active. Disable or rename the legacy built-in account once LAPS manages a new one.
• Skipping the pilot. A rotation setting applied to every PC at once can lock out remote support on a bad day.
• Forgetting offline devices. Laptops that rarely connect still need a recovery path, so test the retrieval process before you need it.
• No logging. If nobody watches retrievals, you have a password vault but no detection. Feed events into the monitoring described in our guide to PowerShell logging and detection.

Unique, rotated administrator credentials map directly to access control requirements in the FTC Safeguards Rule, HIPAA, cyber insurance questionnaires, and CMMC. Carriers increasingly ask whether local admin passwords are unique and managed, and a documented LAPS policy gives you a clean yes. Our Texas SMB IT and cybersecurity benchmark shows how peers handle these controls.

Count how many of your Windows devices still share a local admin password, then pick ten machines for a LAPS pilot this week. If you would rather not do it alone, our IT support team can configure Intune and Entra policies, and our Microsoft 365 managed services and cybersecurity services keep the controls monitored afterward. If you are in the Houston area, our Houston managed IT team can usually start with a same-week assessment.

• Houston managed IT
• Sugar Land managed IT
• The Woodlands managed IT