LAPS Rotation Audit

A PowerShell script that checks whether Windows LAPS is really rotating the local admin password, and forces a rotation when it is not.

Send me the scriptView on GitHub

What it does

  • Looks for the success event that matches your backup target: 10029 for Entra ID, 10018 for Active Directory
  • Uses your policy's Password Age Days plus a small grace period as the window, so the check is based on your real setting, not a guess
  • Flags event 10005 (policy processing failed), which means rotation is actively broken rather than just late
  • Forces a rotation with Reset-LapsPassword when nothing is confirmed
  • Reports only by default. Nothing changes until you set $WhatIf to $false
  • Logs every action to %LOCALAPPDATA%\Atliso\LapsRotationAudit.log

Get the script

From the PowerShell Gallery with Install-Script Atliso-LapsRotationAudit -Scope CurrentUser, or download it from GitHub.

Configuration

You edit one block:

PowerShell
Preview snippet. The full, tested script lives in the vault.
# ══════════════ EDIT THIS BLOCK FOR YOUR ENVIRONMENT ══════════════
$BackupDestination = "EntraID"   # or "ActiveDirectory"
$PasswordAgeDays   = 30           # your policy's Password Age Days value
$GraceDays         = 2            # slack before "late" becomes "broken"
$WhatIf            = $true        # $false to actually force rotation

Deploy in Intune

  1. In the Intune admin center: Devices > Scripts and remediations > Remediations > Create.
  2. Use the detection half (exits 1 when no successful backup is confirmed inside the window) as the detection script.
  3. Use this script with -WhatIf $false as the remediation script.
  4. Run as SYSTEM in the 64-bit PowerShell host.

Reset-LapsPassword hands off to LAPS background processing. Windows LAPS wakes on a fixed hourly cycle, so the new password appears within the next hour, not instantly.

Full walkthrough with screenshots: Windows LAPS Password Not Rotating? The Real Way to Check (and Force It)

Version history

Scripts are checked against each month's Windows and Intune changes and patched when something breaks. Every version stays available: if a newer one misbehaves in your environment, use the one before it and reply to any Atliso email to tell me.

  1. v1.0.1Latest

    Adds PowerShell Gallery metadata (PSScriptInfo) so the script can be installed with Install-Script Atliso-LapsRotationAudit. No change to what the script does.

    Download v1.0.1 from GitHub

  2. v1.0.0

    Initial public release. MIT licensed. Download the zip below or clone the repo. See README for usage and the linked Atliso guide.

    Download v1.0.0 from GitHub

Get LAPS Rotation Audit

We'll send the script plus the deployment checklist, and updates when Microsoft changes something. No spam.