Windows LAPS vs. Legacy LAPS: Why You Should Migrate

What is Windows LAPS?

Windows LAPS is an advanced password management solution built into Windows 10, Windows 11, and Windows Server (starting with the April 2023 update). It replaces the old Legacy LAPS and offers enhanced security, broader integration, and better management options¹.

Legacy LAPS vs. Windows LAPS – The Key Differences

Below are the main differences between Legacy LAPS and Windows LAPS:

1️⃣ Installation & Integration

✅ Legacy LAPS: Requires a separate installation via an MSI file.
✅ Windows LAPS: Is directly integrated into supported versions of Windows; no additional software required!

 

2️⃣ Storage locations for passwords

✅ Legacy LAPS: Storage in Active Directory only.
✅ Windows LAPS: Supports both Active Directory and Azure AD, perfect for hybrid or cloud-first environments. ☁️

 

3️⃣ Encryption of passwords

✅ Legacy LAPS: No encryption options.
✅ Windows LAPS: Supports password encryption in Active Directory, significantly improving security.

4️⃣ Password History

✅ Legacy LAPS: No password history functionality.
✅ Windows LAPS: Tracks password history for auditing and recovery.

 

5️⃣ DSRM Password Management

✅ Legacy LAPS: Does not support Directory Services Restore Mode (DSRM).
✅ Windows LAPS: Can manage DSRM passwords on domain controllers, adding an extra layer of security. ️

 

6️⃣ Automatic actions after password use

✅ Legacy LAPS: Automatic actions are not possible.
✅ Windows LAPS: Automatic reset is possible after retrieving a password.

 

7️⃣ Support for migration

✅ Legacy LAPS: No migration features.
✅ Windows LAPS: Offers a Legacy emulation mode, making it easy for organizations to transition. ️

 

Benefits of Windows LAPS

Why switch to Windows LAPS? Here are the biggest benefits:

Native integration – No separate installation required; Windows LAPS is built into Windows!
Enhanced security – Supports encryption and password history.
Cloud-ready – Works with Azure AD, ideal for modern IT environments.
Supports DSRM password management – Additional functionality for domain controllers.
Easy migration – Legacy emulation mode helps ensure a smooth transition.

 

⚠️ Important Considerations for Implementation

Before making the switch, keep the following in mind:

Legacy LAPS is being phased out – Newer versions of Windows no longer support Legacy LAPS.
Side-by-side deployment is possible – However, each version can manage only one password per local administrator account.

 

Conclusion

Windows LAPS is the future of secure password management for local administrator accounts. It offers better security, integration, and management options than Legacy LAPS. Organizations still using Legacy LAPS are strongly encouraged to migrate to take advantage of the latest improvements and security benefits.

Have you switched to Windows LAPS yet?

 

References

¹https://learn.microsoft.com/windows-server/identity/laps/laps-overview

About the Author

My name is Alta Martes, a specialist in Microsoft 365 and Google Workspace, with a focus on modern workplace management, cloud security, and identity and access management. With years of experience, I help organizations optimize their IT infrastructure and create a secure, efficient digital workplace.

Is there still legacy LAPS running in your environment? ALTA-ICT is migrating to Windows LAPS as part of its management process.

Need help with your Microsoft 365 strategy?
Click below to find out how we can support your organization: