Windows LAPS passwords not visible in Intune portal

Question

I have deployed a Windows LAPS policy via Intune to our Azure AD joined devices, but the local administrator password is not visible in the Intune/Entra portal.

Steps performed:

1. Created a LAPS policy in Intune with Backup directory = Entra ID.
2. Assigned the policy to our Windows 10/11 devices (running 20H2 or later, fully patched).
3. Verified devices are Entra ID joined and show as compliant in Intune.
4. Forced device sync and rebooted endpoints.
5. Checked Event Viewer → LAPS → Operational, but did not see Event ID 10037 (password successfully backed up).
6. Attempted PowerShell verification (Get-LapsPolicy, Get-LapsDiagnostics) but results show no applied LAPS settings.
7. Confirmed RBAC permissions — my account has Intune Administrator rights, but the Local administrator password → Read option is not functioning

Expected result: When selecting a device in the Intune portal under Local administrator password, I should be able to view the current password and expiration time.

Answer 1

That explains why LAPS isn’t showing up on your Windows 11 24H2 Pro edition. On Pro edition, the LAPS feature is not included by default, so you won’t see the policy settings or event logs unless you deploy the legacy LAPS MSI (the older standalone version).

You only have two choice using Windows Pro:

1. Use Legacy LAPS (MSI)
   • Download: Microsoft LAPS (Legacy)
   • Install on your Pro device(s).
   • Works with on-prem Active Directory only, not with Entra ID.
   • Then configure GPO to store local admin passwords in AD.
2. Upgrade to Enterprise/Education
   • Required if you want the new Windows LAPS (native to Windows, cloud-aware, with Azure/Intune integration).
   • On Pro, it will never appear even if you add RSAT or tools.

Answer 2

By the way is you Windows a home or pro edition?

Try this step next if missing. Open PowerShell (Admin) and run this command:

Add-WindowsCapability -Online -Name LAPS.ManagementTools~~~~0.0.1.0

Then confirm:

Get-WindowsCapability -Online | findstr LAPS

Answer 3

Hi!

Thank you for the information. Based on what you describe, the key symptom is: no Event ID 10037, no password backup to Entra ID, and Get-LapsPolicy not showing settings applied. It means the policy is not actually taking effect on the devices, even though you deployed it.

I have two things in mind that might be the root cause of it.

1. Windows version

• Windows LAPS (New LAPS integrates with Entra ID) was only introduceApril 2023 cumulative updates.
• Windows 10/11 20H2 is out of support and does not receive those patches anymore. The new LAPS client simply isn’t present there.
• Supported:
  • Windows 10 21H2/22H2 (with April 2023 or later CU installed).
  • Windows 11 21H2/22H2/23H2 (also patched April 2023+).

Policy delivery

• Intune will happily deploy the setting, but if the OS does not have the new LAPS CSP/engine, it just won’t apply (hence Get-LapsPolicy shows nothing).

2. RBAC vs. backup target

• You’ve chosen Backup directory = Entra ID (which is correct for cloud-only). Since the device isn’t even generating a password, RBAC isn’t the blocker here.

You need to verify first.

a. On an affected endpoint, run PowerShell:

   Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component              Based Servicing\Packages" | Select-String "LAPS"

 Note: If nothing is found, the built-in Windows LAPS isn’t present.

b. You need to update

• Upgrade Windows 10 20H2 endpoints → 22H2.
• Patch all Windows 10/11 devices with the latest cumulative updates so that C:\Windows\System32\laps.dll exists. c. Re-enforce the policy
• After upgrade and patch, trigger Intune sync + reboot.
• Run: (PowerShell)
  • Get-LapsPolicy
  • Get-LapsDiagnostics

Now you should see settings applied.

d. Confirm backup

After successful processing, Event Viewer → Applications and Services Logs → Microsoft → Windows → LAPS → Operational will show Event ID 10037.

In Intune / Entra → Device → Local administrator password, the password and expiration should appear.