Migrate to Windows LAPS from legacy LAPS

ByTech Admin

Here’s a laid-back summary of how to move from the older (legacy) LAPS to the newer Windows LAPS, based on Microsoft’s official guide:learn.microsoft

Fast Track: Quick Switch Method

Want to move quickly? Here’s the gist:

  • Turn off (or remove) your old legacy LAPS policy.
  • Set up and apply your shiny Windows LAPS policy.
  • Keep an eye on your devices to make sure the switch went smoothly.
  • Once you know everything’s working, uninstall the old LAPS software.

Tip: If you’re using the same admin account as before, it’s super easy—just make the change. If not, create any new accounts beforehand and get rid of old ones you don’t need.

When you apply the new Windows LAPS policy, devices immediately rotate their local admin password for you. Be sure to monitor everything during this step!

Take Your Time: Side-by-Side Approach

If you’d rather not rush:

  • Create a second local admin account on the device.
  • Apply the Windows LAPS policy to this new account.
  • Make sure the new LAPS setup is doing its thing.
  • Then turn off or remove the old LAPS policy.
  • Uninstall the legacy LAPS software.
  • Once you’re confident, you can remove that extra admin account you added.

This approach is a bit gentler and lets you double-check everything works before switching off the old system completely.

How to Double-Check Success

You’ve switched—now how do you know it worked?

  • Watch Windows LAPS event logs for confirmation the password got updated.
  • If you use Active Directory to store passwords, check for a fresh or updated msLAPS-PasswordExpirationTime on the computer’s AD object, or use PowerShell (Get-LapsADPassword) to check things out.
  • If you use Microsoft Entra ID, you can spot updates in the Entra or Intune admin portals, or with the Get-LapsAADPassword PowerShell command.

Wrapping Up

After the migration:

  • Remove the old software (how you do it depends on how you installed it—could be an MSI uninstall, or unregistering and deleting a DLL, depending on your setup).
  • Make sure you clean up old accounts you no longer need.

And that’s it—Windows LAPS takes over managing local admin passwords securely!

Want more details? Hit up the full Microsoft page for the nitty-gritty.learn.microsoft

  1. https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-scenarios-migration
  2. https://www.infrastructureheroes.org/microsoft-infrastructure/active-directory/windows-laps-and-the-migration-from-microsoft-laps/
  3. https://mjshellenberger.com/2023/05/30/multi-part-how-to-guide-migrate-from-microsoft-laps-legacy-to-windows-laps-in-a-hybrid-environment-migration-planning-part-1/
  4. https://www.reddit.com/r/sysadmin/comments/1im21sk/migrating_from_legacy_laps_to_new_microsoft_laps/
  5. https://mjshellenberger.com/2023/05/30/multi-part-how-to-guide-migrate-from-microsoft-laps-legacy-to-windows-laps-in-a-hybrid-environment-hybrid-client-migration-part-3/
  6. https://www.ravenswoodtechnology.com/migrating-to-windows-laps/
  7. https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview
  8. https://petri.com/configure-windows-laps/
  9. https://www.oceanleaf.ch/windows-laps-guide/
  10. https://www.alitajran.com/windows-laps/

Similar Posts