LAPS succeeded. Where is the password?

1. Define which LAPS milestone is missing

Your goal is to distinguish four milestones: policy applied → managed account present → password backed up → authorised operator can recover and use it. Evidence for one milestone does not prove all four.

Use a single approved lab device. Password retrieval, authentication and rotation are optional operational tests outside this read-only course exercise; never put passwords in the worksheet or screenshots. Microsoft prerequisites and roles.

2. Read policy and account-management evidence

Go to Endpoint security → Account protection → your Windows LAPS policy → View report. Open the device and its per-setting results. Confirm assignment to the intended pilot group, with no competing policy for the same settings.

The earlier pilot used automatic account management. This mode creates and manages the account and its local Administrators membership. A competing “create LAPS admin” script is unnecessary for that design and can conflict with its protections. With manual management of a custom account, the account must already exist. Microsoft account-management modes.

When automatic name randomisation is enabled, the suffix changes with password rotation. Retrieve the current account name when performing an authorised recovery; do not rely on a name copied from an older screenshot. LAPS CSP.

3. Check the directory backup without revealing a password

For the Entra-backed device, open Devices → All devices → pilot → Local admin password. Inspect metadata first. Do not select Show local administrator password for screenshots.

The earlier pilot recorded an initial Entra backup and local password update on 16 October. The fresh screenshot provides current directory metadata. It does not demonstrate that we signed in with the credential or deliberately triggered and validated a new rotation during this session.

On your own endpoint, use Event Viewer → Applications and Services Logs → Microsoft → Windows → LAPS → Operational. If authorised and able to read the log, this command returns selected event metadata without printing passwords:

Get-WinEvent -FilterHashtable @{
  LogName='Microsoft-Windows-LAPS/Operational'
  StartTime=(Get-Date).AddDays(-1)
  Id=10003,10004,10005,10020,10029
} | Select-Object TimeCreated, Id, RecordId

Correlate events from the same processing cycle with the device and backup metadata. Missing events in a one-day window may mean no rotation occurred in that interval; expand the time window deliberately. An access-denied error when reading logs is not a LAPS failure. Microsoft event definitions.

If event 10005 reports a failure

1. In the same LAPS → Operational log, open the 10005 event matching the recorded time and RecordId.
2. On the General tab, read the complete message and error code. The metadata command above intentionally does not display the message.
3. Review the events between the matching 10003 start and 10005 failure. Record the exact hexadecimal code, timestamps and relevant event IDs in the private worksheet.
4. Use the code and intervening events to choose the next check. A 10005 alone establishes a failed cycle, not its cause. Share only sanitised excerpts through the approved support channel.

4. Diagnose access separately from deployment

First identify the operation that failed. Reading directory credentials and using Intune’s device action are separate permission checks.

These are permission identifiers and categories to check in the operator’s existing role assignments. Confirm the correct signed-in account, assignment scope and any required role activation before requesting a change. Grant only the approved task and device scope. Microsoft LAPS prerequisites and RBAC.

Role-name trap: the Microsoft Entra Intune Administrator role can retrieve LAPS passwords, but it does not include the Intune Rotate Local Admin Password action. Microsoft requires a custom Intune role for that action; no built-in Intune role includes it. Diagnose the specific permission rather than assuming that an administrator title covers both operations.

5. Write the validation boundary and next test

The recorded pilot used a seven-day password age. With Entra backup, seven days is also the minimum supported PasswordAgeDays. This is a platform constraint, not a universal business recommendation. Microsoft policy settings.

Microsoft references

Checked 6 November 2026. Portal labels and product behaviour can change; follow the linked applicability and permissions guidance for your environment.

1. Windows LAPS in Microsoft Intune: prerequisites and RBAC
2. Monitor Windows LAPS policy
3. Windows LAPS account management modes
4. Windows LAPS event log
5. Windows LAPS policy settings
6. LAPS CSP