This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(160, 55.00000000000001%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVF%3C/text%3E%3C/svg%3E)
Can we configure local-administrator-password-solution for devices in Microsoft Intune portal
Other Intune-related topics, including unsupported scenarios and platform-specific behaviors
some interesting thread for your information https://www.reddit.com/r/Intune/comments/na49yy/laps_in_administrative_templates_can_i_do/
Thanks,
Eswar
Answer accepted by question author
This solution worked for me
https://www.lieben.nu/liebensraum/2021/06/lightweight-laps-solution-for-intune-mde/
@Vanier Francis Thanks for the sharing. It will helpful to anyone who has the similar confusion.
Thanks again and have a nice day. : )
We did consider this - how secure would you rate this solution though?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(288, 49%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ET%3C/text%3E%3C/svg%3E)
Hi,
The logging for the remediation output posted back to Intune is written in plain text to C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\AgentExecutor.log, which has NTFS ACLs as Everyone\RW and Users\RO.
Probably a bit too risky for untrustworthy local non-admins!
Do you consider this a threat from logged on users, or from people "outside" the device?
In the log file you only see the execution
<![LOG[write output done. output = LeanLAPS ran successfully for LCAdmin
But the password is not visible in the logfile. You only see it in plain text in the Remediation Report console in the Intune MEM. If necessary you can encrypt it, so that it is only readable via Powershell.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(48, 97%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERO%3C/text%3E%3C/svg%3E)
Hi, it looks like the setting "Additional local administrators on Azure AD joined devices" (a premium edition capability) allows this in the Azure portal
https://learn.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal
Perhaps the best method, then ensure the default local Administrator's account is still disabled but has a password set. which we rename and randomise the password with a monthly script push via Intune.
Therefore, if for some odd occurrence you lose network connectivity (seldom happens but it might one day when you dont want it too!) and cannot login using the AAD Additional Admins, can at least safe mode login with local administrators and do some recovery tasks etc.
Anyone using CloudLAPS : https://msendpointmgr.com/cloudlaps/ ?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(147.20000000000002, 84%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELF%3C/text%3E%3C/svg%3E)
Synergix SEVA Community Edition, Free, offers LAPS for Azure AD Joined computers
https://www.synergix.com/products/secrets-vault/features/laps-for-azure-ad/
Higher Editions offer more features
Hi @Vanier Francis ,
As far as I know you cannot as of today, this is a highly requested feature though, you can vote on it over at the Microsoft Endpoint Manager uservoice page over here:
https://microsoftintune.uservoice.com/forums/291681-ideas/suggestions/34248085-add-laps-support-into-intune
----------
(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)
Best regards,
Leon
@Vanier Francis Haven't heard from you for a long time, I am currently standing by for further update from you and would like to know how things are going. If you have any questions or concerns, please don't hesitate to let us know.
Hey Leon - the link is dead, does that mean Microsoft are about to implement LAPS for AAD devices? :)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(156.8, 97%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPI%3C/text%3E%3C/svg%3E)
I wish I could say it was, but it is actually the Intune user Voice that is no more. Try here instead: