Windows LAPS
LAPS is a Microsoft feature built into Windows that gives the local administrator account on every PC its own random password, changes it automatically and stores it securely. It helps with Cyber Essentials because default or guessable passwords must be changed (A5.3) and every account needs unique credentials (A7.2). One admin password copied onto every laptop meets neither.
- Term
- LAPS
- Also known as
- Local Administrator Password Solution, Windows LAPS, Local admin password management
- Category
- Accounts and access
- Requirement area
- 4. User Access Control; 2. Secure Configuration
- Reviewed against
- Requirements v3.3
What does the term LAPS mean in Cyber Essentials?
LAPS is a Microsoft feature built into Windows that gives the local administrator account on every PC its own random password, changes it automatically and stores it securely.
How does LAPS apply to Cyber Essentials?
In plain terms
Every Windows PC has a built-in local administrator account. In many offices it ends up with the same password on every machine, set once when the PCs were first installed. That is like fitting the same lock to every flat in a building: one lost key opens them all. LAPS gives every PC its own lock and changes the key on a schedule. The current password is stored in Microsoft Entra ID or Active Directory, where only authorised admins can look it up.
What Cyber Essentials asks
The scheme does not name LAPS. The rules it helps with are:
- "change any default or guessable account passwords" (secure configuration, asked at A5.3)
- "authenticate users with unique credentials before granting access to applications or devices" (A7.2)
- separate accounts for admin work, which A7.6 says "applies to local administrator accounts"
The NCSC requirements count local administrators as administrator accounts. The alternative, where the built-in account is not needed, is to disable it, which A5.2 on unnecessary accounts supports.
Common mistakes
- Setting up LAPS but leaving the old shared password on machines outside its policy.
- Giving too many people permission to read LAPS passwords. Access to them is itself privileged access, so track it with your admin list (A7.8).
See the default password rules and the Windows 11 setup guide. Related: administrator account, Active Directory, default password.
Related terms
- Administrator accountAn administrator account is a login with extra powers, such as installing software, changing security settings and creating other accounts.
- Active Directory (AD)Active Directory is Microsoft's system, run on a Windows server in your own office or data centre, that holds the central list of staff logins, computers and permissions.
- Default passwordA default password is the password a device or piece of software comes with from the factory, before anyone in your organisation has set their own.
- Account lockoutAccount lockout is a setting that blocks further login attempts after a set number of wrong passwords or PINs, so a guesser cannot keep trying.
- Authenticator appAn authenticator app is a phone app that confirms it is really you logging in, either by showing a short code that changes every few seconds or by asking you to tap to approve.
- BiometricsBiometrics means using a part of your body, such as a fingerprint or your face, to prove who you are instead of typing a password.
Frequently asked questions
LAPS is a Microsoft feature built into Windows that gives the local administrator account on every PC its own random password, changes it automatically and stores it securely.
In the 2026 Danzell question set, LAPS comes up at A5.2, A5.3, A7.2, A7.6. Read those questions against the definition above so your answers use the term the way the assessor will.
LAPS relates to 4. User Access Control; 2. Secure Configuration in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.