LAPS Rotation Audit

A PowerShell script that checks whether Windows LAPS is really rotating the local admin password, and forces a rotation when it is not.

Get it by emailView on GitHub

What it does

  • Looks for the success event that matches your backup target: 10029 for Entra ID, 10018 for Active Directory
  • Uses your policy's Password Age Days plus a small grace period as the window, so the check is based on your real setting, not a guess
  • Flags event 10005 (policy processing failed), which means rotation is actively broken rather than just late
  • Forces a rotation with Reset-LapsPassword when nothing is confirmed
  • Reports only by default. Nothing changes until you set $WhatIf to $false
  • Logs every action to %LOCALAPPDATA%\Atliso\LapsRotationAudit.log

Configuration

You edit one block:

PowerShell
Preview snippet. The full, tested script lives in the vault.
# ══════════════ EDIT THIS BLOCK FOR YOUR ENVIRONMENT ══════════════
$BackupDestination = "EntraID"   # or "ActiveDirectory"
$PasswordAgeDays   = 30           # your policy's Password Age Days value
$GraceDays         = 2            # slack before "late" becomes "broken"
$WhatIf            = $true        # $false to actually force rotation

Deploy in Intune

  1. In the Intune admin center: Devices > Scripts and remediations > Remediations > Create.
  2. Use the detection half (exits 1 when no successful backup is confirmed inside the window) as the detection script.
  3. Use this script with -WhatIf $false as the remediation script.
  4. Run as SYSTEM in the 64-bit PowerShell host.

Reset-LapsPassword hands off to LAPS background processing. Windows LAPS wakes on a fixed hourly cycle, so the new password appears within the next hour, not instantly.

Full walkthrough with screenshots: Windows LAPS Password Not Rotating? The Real Way to Check (and Force It)

Get LAPS Rotation Audit

We'll send the script plus the deployment checklist, and updates when Microsoft changes something. No spam.