Glossary
LAPS
LAPS (Local Administrator Password Solution) gives every Windows machine a unique, rotated local admin password stored securely in AD or Entra ID.
The Local Administrator Password Solution automatically sets a random, unique password for the built-in local administrator account on each domain-joined computer, rotates it on a schedule, and stores it as a protected attribute on the computer object in Active Directory (or in Microsoft Entra ID). Windows LAPS, built into Windows since April 2023 updates, replaces the older standalone "legacy LAPS" and adds password encryption, password history, DSRM password management for domain controllers and automatic rotation after use.
It matters because a shared local administrator password is one of the fastest ways to move laterally: compromise one workstation, reuse the same hash everywhere with pass-the-hash. LAPS breaks that reuse. The security of LAPS then depends on who can read the password attribute, so audit the "All extended rights" and read permissions on computer OUs, enable encryption so only an authorised group can decrypt the password, and log password retrievals so unusual access can be spotted.