LAPS improvements for Windows 11 24H2

UPDATE: 24H2 Laps improvements are in the Intune GUI!

If only I had waited a few more weeks! Back on the 12th of March, I posted this article on the 24H2 Laps improvements, which were only available via OMA-URI at the time. I wasn’t sure we would see it in the GUI for some time.

On Friday, I read the What’s New on Microsoft Intune page and found that the 24H2 Laps improvements have made it to the GUI! Take a look here for the official post (there are plenty of other improvements, too): https://learn.microsoft.com/en-us/intune/intune-service/fundamentals/whats-new#week-of-march-17-2025-service-release-2503

So I quickly logged into the lab to verify, and it was there in all its glory! You will only see the Automatic Account Management Enabled at first, but once you select that, you can see the rest. I removed the custom policy and applied a new policy via Endpoint Security – Account Protection (as seen below), and all is working as it should (without custom policy) – hooray! Please remember that this is for 24H2 and above only, so assign this policy accordingly.

It’s great to see these improvements coming in thick and fast for Intune.

Original post

Let’s be honest – your mass-deployed local admin accounts are rarely, if ever, updated. That’s where a Local Administrator Password Solution (or LAPS for short) comes in. LAPS is an essential tool for securing endpoints from these mass-deployed local admin accounts by automatically rotating your local admin account password on a schedule or after each use.

In Windows 11 24H2, there are some improvements to LAPS that improve the experience for IT administrators and make things more difficult for those pesky attackers.

Unfortunately, these new settings are not available in the Intune Graphical User Interface (GUI) via Endpoint Security/Account Protection/LAPS, so for now, we will have to use a Custom Policy with OMA-URI settings. Hopefully, these will be migrated to the GUI soon.

First, let’s look at three new settings that work together to shake up the local admin account creation.

• AutomaticAccountManagementNameOrPrefix
  • OMA-URI ./Device/Vendor/MSFT/LAPS/Policies/AutomaticAccountManagementNameOrPrefix
  • Value Type = String

This setting will allow you to set either a name for the account or a prefix (works great with Randomise Name below!)

• AutomaticAccountManagementRandomizeName
  • OMA-URI ./Device/Vendor/MSFT/LAPS/Policies/AutomaticAccountManagementRandomizeName
  • Value Type = Boolean (True to Enable)

This setting allows you to randomise the username of the account on password rotation – this is my favourite part, as it keeps moving the goalposts for anyone trying to move around your network using a static account.

• AutomaticAccountManagementTarget
  • OMA-URI ./Device/Vendor/MSFT/LAPS/Policies/AutomaticAccountManagementTarget
  • Value Type Integer (1 to Create new account)

This setting will use the built-in admin account or create a new account. Ok, let’s call it a tie between randomising the name and auto-creating the account for my favourite update – no more scripts or custom policies to create the account (this itself is a custom policy currently).

Setting those three items won’t do much; you need to adjust other required settings to have a functioning LAPS policy. These include Backup Directory, Automatic Account Management Enabled, Password Complexity, and Password Length.

See the table at the end of this article for a functioning example policy!

What does this look like in practice?

In this example, the policy created a new account (the prefix was set to EFX).

On rotation, both the password and username have been updated.

If you are running Windows 11 24H2 in your organisation, mention these improvements to your security team or your SOE/Endpoint Team and see if you can implement this to improve your security posture.

For the complete documentation of the LAPS CSP, please see https://learn.microsoft.com/en-us/windows/client-management/mdm/laps-csp

Here’s an example of a working policy that you can adjust to suit your company and desired security policies.

We’re keen to see this being brought into the Intune GUI – stay tuned and we’ll publish another update when that happens.