When you talk to executives about privileged access, they hear "passwords" and "admin rights." What they don't hear is that the default Windows admin model gives every machine a local administrator account whose password is usually identical everywhere and never changes.

Why LAPS Matters

LAPS (Local Administrator Password Solution) solves the "same password on every workstation" problem by giving each machine its own random local admin password, rotating it automatically (every 30 days by default), and storing it in AD or Entra ID where only a tightly scoped group can read it.

Use Windows LAPS, which is built into Windows 11, Windows 10 and Windows Server 2019/2022 (via the April 2023 updates) and Server 2025. The older "legacy" Microsoft LAPS (AdmPwd) is deprecated - if you still run it, plan the migration. Windows LAPS has no module to install; the LAPS PowerShell module ships with the OS.

# One-time: extend the schema (Schema Admin, run once per forest) Update-LapsADSchema # Let computers in the OU write their own password Set-LapsADComputerSelfPermission -Identity 'OU=Workstations,DC=corp,DC=local' # Allow only the LAPS readers group to read passwords Set-LapsADReadPasswordPermission -Identity 'OU=Workstations,DC=corp,DC=local' ` -AllowedPrincipals 'CORP\LAPS Workstation Readers' # Audit who can actually read them (inherited rights included) Find-LapsADExtendedRights -Identity 'OU=Workstations,DC=corp,DC=local'

Password length, complexity and age aren't set with a cmdlet - they come from policy. In Group Policy that's Computer Configuration → Administrative Templates → System → LAPS: set Configure password backup directory to Active Directory, Password Settings to (for example) 20 characters and 30 days, and turn on Enable password encryption if your domain functional level is 2016 or higher. Intune has the same settings for cloud-managed devices.

In practice, LAPS eliminates the "admin password spreadsheet" and makes a local admin password dumped from one machine useless on every other machine.

PAW - The Workstation You Actually Trust

A Privileged Access Workstation (PAW) is a hardened, dedicated device used only for administrative tasks. It isn't air-gapped - it has to reach the systems it manages - but it's isolated from everything else. The idea is simple: separate the high-risk everyday environment (email, browsing, documents) from the high-value admin environment.

Deploying PAWs reduces the attack surface dramatically. If an admin clicks a malicious link on their regular laptop, the attacker gets that laptop - but the admin's privileged credentials were never used there, and the PAW doesn't accept inbound connections from it.

Just-In-Time (JIT) Elevation

Even with LAPS and PAWs, admins still need privileged rights occasionally. JIT means those rights are granted for a short window (usually 1-4 hours) and removed automatically, so there's no standing privileged access for an attacker to steal.

For cloud roles, Entra ID Privileged Identity Management (PIM) handles this for Entra roles, Azure resource roles and PIM-managed groups. For on-premises AD, use AD's built-in time-limited group membership rather than a homegrown script:

# One-time: enable the Privileged Access Management optional feature # (requires Windows Server 2016 forest functional level; cannot be disabled once enabled) Enable-ADOptionalFeature 'Privileged Access Management Feature' ` -Scope ForestOrConfigurationSet -Target 'corp.local' # Grant Domain Admins for 2 hours - AD removes the membership itself Add-ADGroupMember -Identity 'Domain Admins' -Members 'jdoe-t0' ` -MemberTimeToLive (New-TimeSpan -Hours 2) # See remaining time on current memberships Get-ADGroup 'Domain Admins' -Property member -ShowMemberTimeToLive | Select-Object -ExpandProperty member

Why not Add-ADGroupMember, Start-Sleep, Remove-ADGroupMember? Two reasons. If the script is interrupted - reboot, closed window, crash - the user stays a Domain Admin permanently. And removing someone from a group doesn't end the access they already have: their Kerberos ticket keeps the old group membership until it expires, up to 10 hours later. With the PAM feature, AD removes the membership itself and caps the ticket lifetime at the remaining time-to-live.

Key points for a secure JIT implementation:

Putting It All Together - A Practical Blueprint

Below is a checklist you can copy into your runbook:

# 1. Deploy Windows LAPS to all domain-joined machines Update-LapsADSchema Set-LapsADComputerSelfPermission -Identity 'OU=Workstations,DC=corp,DC=local' Set-LapsADReadPasswordPermission -Identity 'OU=Workstations,DC=corp,DC=local' ` -AllowedPrincipals 'CORP\LAPS Workstation Readers' # - GPO/Intune: backup to AD, 20 chars, 30 days, encryption on # - Repeat per OU (servers get their own readers group) # 2. Build a PAW image (see Microsoft's privileged access device guidance) # - Credential Guard, BitLocker, WDAC/AppLocker # - No email or general browsing; inbound connections blocked # - Tier 0 logon restrictions: T0 accounts log on only to PAWs and T0 systems # 3. Configure JIT # - Cloud: Entra PIM - MFA on activation, max 2h, approval for Global Admin # - On-prem: PAM feature + Add-ADGroupMember -MemberTimeToLive # - Alert on every Tier 0 grant (4728/4732/4756) # 4. Operational process # - All admin work is performed from a PAW # - LAPS passwords retrieved with Get-LapsADPassword, from PAWs only # - No standing members in Domain Admins except break-glass accounts

Final Thought

LAPS, PAWs, and JIT are not silver bullets. They each solve a piece of the privileged-access puzzle: LAPS stops one stolen local password from unlocking every machine, PAWs keep privileged credentials away from the places attackers land, and JIT means there's usually no standing privilege to steal at all. Used together, they force an attacker to get past three independent controls before gaining lasting domain admin.

Implement them, enforce the process, and you'll see a dramatic drop in "admin password reuse" findings during audits.