LAPS Passwords

The LAPS Passwords check verifies on Windows devices (x64, ARM64) that the local administrator password is actually managed and escrowed by LAPS. It detects Windows LAPS and legacy LAPS 1.0 and checks the managed account, the password age, the backup to Active Directory or Microsoft Entra ID, and the LAPS event logs for failed cycles. It runs locally through the octoja agent, every 60 minutes by default.

Prerequisites

• You need the Monitoring Check Management permission.

Steps

1. Go to Devices and open the device.
2. Click the Checks tab → Add Check → LAPS Passwords.
3. Adjust the settings if needed.
4. Click Add Check.

To roll it out to many devices at once, use a config package.

Settings

Fields marked "Advanced" only appear after you turn on Show advanced options.

• With 0 for an age, the check uses the rotation interval from the LAPS policy; if none is set, it assumes 30 days. With the defaults, a warning therefore starts at 32 days and critical at 37 days.
• If the critical age is not above the warning age, the check sets it to the warning age + 1 day.
• For backup to Active Directory, the check queries the computer object in the directory. If you turn on Skip directory lookup, it can only prove escrow from the local event log; without a matching event, the result stays at a warning.

Results

The check collects every problem it finds. The overall result is the highest severity.

See also: Assign checks with config packages · Set up alerts for a check