WINDOWS LAPS WITH INTUNE - PILOT AND RECOVERY CHECKLIST
Tiago S. Carvalho | 16 October 2026
Guide: https://www.tiagoscarvalho.com/microsoft-intune/windows-laps-intune-deployment-recovery-2026

Use this worksheet inside your organisation. Do not record passwords here.
The example profile values in the guide are design choices, not a Microsoft baseline.

CHANGE RECORD
[ ] Owner, approver, maintenance window and support contact recorded
[ ] Pilot device IDs and Windows editions/builds recorded
[ ] Join type and selected backup directory verified
[ ] Tenant LAPS setting and operator permissions reviewed
[ ] Existing LAPS/GPO/account-management policies inventoried
[ ] Current profile and assignments exported or documented
[ ] Recovery route confirmed before changing any account

POLICY AND ACCOUNT
[ ] One intended LAPS configuration per pilot device
[ ] Supported Windows release; automatic account management requires 24H2+
[ ] Custom account strategy, enabled state and name randomisation selected
[ ] Password age, complexity and length documented
[ ] Post-authentication delay/action reviewed with the support team
[ ] No overlap between pilot and incompatible existing policies

EVIDENCE - ONE ROW PER DEVICE IN YOUR CHANGE RECORD
[ ] Intune assignment and per-setting results checked
[ ] Endpoint event 10022 reviewed for Entra policy configuration
[ ] Endpoint event 10029 confirms a password backup to Entra
[ ] Endpoint event 10020 confirms local password update
[ ] Entra backup timestamp and correct device ID verified
[ ] Authorised operator can retrieve this device's current credential
[ ] Unauthorised operator cannot retrieve it; out-of-scope device tested
[ ] Controlled local recovery test completed
[ ] Online manual rotation completed and new evidence checked
[ ] Post-authentication action observed during the test window
[ ] Recovery and update audit events located
[ ] Passwords absent from tickets, screenshots, logs and the evidence pack

EXCEPTIONS AND EXPANSION
[ ] Offline, stale, missing and unsupported devices have named owners
[ ] Missing LAPS records reconciled with the intended device inventory
[ ] Metadata report treated as a review list, not compliance evidence alone
[ ] Former managed accounts reviewed before changing target account
[ ] Pause/rollback steps and fallback management source documented
[ ] No Entra device object deletion before recovery requirements are closed
[ ] Next ring approved only after every required pilot test passes

TEST RECORD (repeat per case)
Device ID:
Policy/version:
Operator role and scope:
Test and expected result:
Actual result:
UTC time:
Evidence reference (no secrets):
Exception/owner/next action:

VALIDATION NOTE
This worksheet contains no tenant findings. Run and retain the evidence in your
own environment. The companion PowerShell report reads metadata only.