Windows LAPS (Local Administrator Password Solution) plays a critical role in securing local administrator accounts across devices in modern endpoint management. It ensures that every machine has a unique, regularly rotated password, dramatically reducing the risk of lateral movement during security incidents.
However, security is only half of the story. When a user is locked out at the start of the workday or a technician urgently needs administrative access, how quickly you can retrieve that password becomes just as important as how securely it’s stored. The reality is that not all retrieval methods are equal; some introduce unnecessary friction that can slow down your helpdesk operations. Let’s walk through the most common approaches and see how they compare in real-world scenarios.
The Scenario
Picture a typical support situation: a user is locked out of their Windows device, or a technician needs elevated access to troubleshoot an issue. The helpdesk must retrieve the current LAPS password for that specific device, quickly, accurately, and securely.
At this point, the tool you choose directly impacts resolution time.
Searching with Standard Microsoft Tools: The Entra ID Portal
While Entra ID stores these passwords securely, the native portal isn’t exactly built for speed.
To find a password in the Microsoft Entra ID Portal, you have to:
- Navigate to Devices > All Devices.
- Search or filter for the specific device.
- Open the device record and find the LAPS blade.
The biggest limitation is the lack of a global LAPS password search. If the exact device name isn’t known, administrators are forced to manually filter or scroll through device lists. In organizations managing hundreds or thousands of endpoints, this quickly becomes inefficient and error-prone.
For on-premises environments using Active Directory Users and Computers, the experience is similarly constrained. Accessing LAPS passwords requires installing an additional plugin before the data is even visible, adding another layer of setup and dependency.
Find LAPS Password in Entra ID Using PowerShell
For those who prefer automation, you can use the Microsoft Graph PowerShell module. This requires the DeviceLocalCredential.Read.All permission.
# Connect with the required permissions
Connect-MgGraph -Scopes "DeviceLocalCredential.Read.All"
# Define your target device
$deviceName = "DESKTOP-ABC123"
# Fetch the device ID and the LAPS credential
$device = Get-MgDevice -Filter "displayName eq '$deviceName'" $lapsCred = Get-MgDeviceLocalCredential -DeviceId $device.Id
# Decode and display the password
$lapsCred.Credentials | Select-Object AccountName, PasswordExpirationDateTime, ` @{N="Password";E={[System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($_.PasswordBase64))}} Despite its flexibility, this method introduces a different kind of challenge. It requires familiarity with PowerShell, appropriate permissions, and careful testing before production use. For many helpdesk teams, this creates a skill barrier that slows down day-to-day operations. Additionally, just like the portal, this approach still depends on knowing the exact device name, which can be a bottleneck in time-sensitive situations.
A Better Way to Find a LAPS Password in Microsoft
EasyEntra is designed to remove the friction from LAPS password retrieval by simplifying the entire workflow. Instead of navigating multiple layers or running scripts, administrators can open a device’s properties and immediately access LAPS data within a dedicated tab. The current password is displayed instantly, with options to copy or rotate it in just a click.
Finding LAPS Password in Microsoft Using EasyEntra
- Search and open the target device’s properties in EasyEntra.
- Navigate to the LAPS tab.
- View the current password instantly.
- Use Copy to place it on the clipboard.
- Use Expire to trigger immediate rotation or schedule the next expiration.
This approach reduces retrieval time from minutes to seconds, making it especially effective in high-pressure helpdesk scenarios.
Beyond speed, EasyEntra also removes complexity in hybrid environments. On-premises and cloud device properties are structured in the same way, meaning there is no difference in how administrators locate LAPS data or other settings.
For first-line support teams, this consistency eliminates guesswork and enables seamless management of environments that include both Active Directory joined and Entra joined devices, all through a unified interface.
It’s worth noting that pass-through Active Directory authentication is required to decrypt encrypted LAPS passwords. However, even without it, administrators can still trigger password expiration using explicit authentication.
