---
title: "Stop Missed Windows LAPS Password Rotations with PowerShell"
description: "Use PowerShell and Microsoft Graph to find every Windows LAPS device that missed its password rotation, then read the event log to learn why."
canonical: "https://adamtheautomator.com/windows-laps-password-rotation-powershell/"
---

# Stop Missed Windows LAPS Password Rotations with PowerShell

> Use PowerShell and Microsoft Graph to find every Windows LAPS device that missed its password rotation, then read the event log to learn why.

Source: https://adamtheautomator.com/windows-laps-password-rotation-powershell/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![Stop Missed Windows LAPS Password Rotations with PowerShell](https://adamtheautomator.com/wp-content/uploads/publisher/3ec5d9c85b2b8187987ee10bb8418c2e/df35045971c29173353726a0ebe22dbc4533b795b7b720908e572c5ba8ddeeb9.jpg)

# Stop Missed Windows LAPS Password Rotations with PowerShell

[![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)19 October 20263 min. read

Categories: [Information Security](/category/infosec/)

Tags:[PowerShell](/tag/powershell/)[Active Directory](/tag/active-directory/)[Microsoft LAPS](/tag/microsoft-laps/)[Microsoft Entra](/tag/microsoft-entra/)

Table of Contents

*   [Prerequisites](#prerequisites)
*   [List Every Windows LAPS Device That Missed Its Rotation](#list-every-windows-laps-device-that-missed-its-rotation)
*   [The Active Directory Variant](#the-active-directory-variant)
*   [Find Out Why a Device Stopped Rotating](#find-out-why-a-device-stopped-rotating)
*   [Query the Newest Events](#query-the-newest-events)
*   [Read the Results](#read-the-results)
*   [Force a Rotation Only After You Know the Cause](#force-a-rotation-only-after-you-know-the-cause)
*   [Reset-LapsPassword Is the Last Step](#reset-lapspassword-is-the-last-step)
*   [Keep the Check Running](#keep-the-check-running)

Suppose one laptop quit rotating its local administrator password three weeks ago. Which report would tell you?

Say you checked Intune first. Its policy report and the Windows LAPS (Local Administrator Password Solution) [configuration service provider](https://learn.microsoft.com/en-us/windows/client-management/mdm/laps-csp) (CSP) would tell you only that your settings arrived and whether the last manual reset worked.

## Prerequisites

If you want to follow along, you need four things:

*   Windows devices that back up to Microsoft Entra ID, the only ones the Graph call lists, running [supported Windows versions](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview) (older builds need the April 2023 update).
    
*   The [Microsoft Graph PowerShell SDK](https://learn.microsoft.com/en-us/powershell/microsoftgraph/installation) and a role that reads LAPS metadata, for example Helpdesk Administrator. The `DeviceLocalCredential.ReadBasic.All` scope returns expiry and backup times, never passwords. The paging and overdue filter below ran against sample data on PowerShell 7.6.6.
    
*   A PowerShell session run as administrator on the device you investigate, for the bundled LAPS module.
    
*   For the Active Directory variant, the ActiveDirectory module from [RSAT](https://learn.microsoft.com/en-us/troubleshoot/windows-server/system-management-components/remote-server-administration-tools) and read access to the computers’ LAPS expiration attribute.
    

## List Every Windows LAPS Device That Missed Its Rotation

LAPS rotates a device’s password when the stored expiry arrives. In Entra ID that time is the `refreshDateTime` on each record from the [list deviceLocalCredentialInfo](https://learn.microsoft.com/en-us/graph/api/directory-list-devicelocalcredentials?view=graph-rest-1.0) endpoint, which covers the whole tenant in one paged call.

[Get-LapsAADPassword](https://learn.microsoft.com/en-us/powershell/module/laps/get-lapsaadpassword?view=windowsserver2025-ps) works per device and fails on duplicate device names. Save this as `Get-LapsOverdue.ps1`:

```powershell
Connect-MgGraph -Scopes 'DeviceLocalCredential.ReadBasic.All' -NoWelcome

$uri = 'https://graph.microsoft.com/v1.0/directory/deviceLocalCredentials'
$records = while ($uri) {
    $page = Invoke-MgGraphRequest -Method GET -Uri $uri
    $page.value
    $uri = $page['@odata.nextLink']
}

$cutoff = (Get-Date).AddHours(-2)
$overdue = $records |
    ForEach-Object {
        [pscustomobject]@{
            DeviceName = $_.deviceName
            DeviceId   = $_.id
            LastBackup = [datetime]$_.lastBackupDateTime
            RefreshDue = [datetime]$_.refreshDateTime
        }
    } |
    Where-Object { $_.RefreshDue -lt $cutoff } |
    Sort-Object RefreshDue

$overdue | Format-Table -AutoSize
if ($overdue) { exit 1 }
```

The [Windows LAPS architecture page](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-concepts-overview#background-policy-processing-cycle) says “Windows LAPS uses a background task that wakes up every hour to process the currently active policy.” Anything more than two hours past expiry means a full cycle ran without rotating.

Run the script with `pwsh -File .\Get-LapsOverdue.ps1`, because `exit` closes an interactive session. Your scheduler alerts on the nonzero exit code. The screenshot below shows the longest-overdue device first.

![Overdue LAPS devices](https://adamtheautomator.com/wp-content/uploads/publisher/482698d163179fca5c62a1e4eaeff3e9187625e844223d3b335693a8c731c481.jpg)

* * *

_**Reality Check: LAPS can’t rotate a laptop that’s powered off. It’s also _**[_**disabled in Safe Mode and other non-normal boot modes**_](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-concepts-overview#disabled-in-windows-safe-mode)**_. Check the device’s last sign-in in Entra before you open a ticket.**_

* * *

### The Active Directory Variant

Devices that back up to Active Directory [poll the directory each cycle](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-concepts-overview), so the same cutoff applies. [Get-LapsADPassword](https://learn.microsoft.com/en-us/powershell/module/laps/get-lapsadpassword?view=windowsserver2025-ps) takes computer names from the pipeline and exposes the expiry as `ExpirationTimestamp`:

```powershell
Get-ADComputer -Filter * -SearchBase 'OU=Workstations,DC=contoso,DC=com' |
    Select-Object -ExpandProperty Name |
    Get-LapsADPassword |
    Where-Object { $_.ExpirationTimestamp -lt (Get-Date).AddHours(-2) } |
    Select-Object ComputerName, PasswordUpdateTime, ExpirationTimestamp
```

## Find Out Why a Device Stopped Rotating

Pick one overdue device and read its [Windows LAPS event log](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log), where four rows of events answer most questions:

| Event ID | What it tells you |
| --- | --- |
| 10021 or 10022 | The policy in effect: source, backup directory, password age |
| 10004 or 10005 | The cycle succeeded or failed (10005 carries an error code) |
| 10018 or 10029 | A new password reached Active Directory or Entra ID |
| 10020 | The local account took the new password |

One hourly cycle starts at event 10003 and ends at 10004 or 10005, as the diagram below shows.

![LAPS hourly cycle events](https://adamtheautomator.com/wp-content/uploads/publisher/e49fec30cb6c67abff031d12c11720101dd04e8214265daa51d7eb6fc59dea51.jpg)

### Query the Newest Events

Run all three [Get-WinEvent](https://adamtheautomator.com/get-winevent/) queries from the administrator session:

```powershell
$log = 'Microsoft-Windows-LAPS/Operational'

# Which policy is the device running?
Get-WinEvent -FilterHashtable @{ LogName = $log; Id = 10021, 10022 } -MaxEvents 1 |
    Select-Object TimeCreated, Message

# Did the last cycle finish?
Get-WinEvent -FilterHashtable @{ LogName = $log; Id = 10004, 10005 } -MaxEvents 1 |
    Select-Object TimeCreated, Id, Message

# When did a new password last reach the directory?
Get-WinEvent -FilterHashtable @{ LogName = $log; Id = 10018, 10029 } -MaxEvents 1 |
    Select-Object TimeCreated, Id
```

### Read the Results

| Query | Result | Meaning |
| --- | --- | --- |
| First | No 10021 or 10022 event | Backup is disabled |
| First | Source is Group Policy for a setting you assigned in Intune | The CSP settings never landed |
| Second | A 10005 event | Find the failure event logged just before it, such as 10028, and look up that event ID in Microsoft’s [LAPS troubleshooting guidance](https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/windows-laps-troubleshooting-guidance) |

Read the backup time from the script’s `LastBackup` column. With backup enabled, each cycle writes at least three events, which can push the last 10029 out of a busy log before the next rotation is due.

## Force a Rotation Only After You Know the Cause

After you fix the cause, rerun policy processing. The same architecture page calls [Invoke-LapsPolicyProcessing](https://learn.microsoft.com/en-us/powershell/module/laps/invoke-lapspolicyprocessing?view=windowsserver2025-ps) the preferred manual trigger “because it’s more scoped” than a Group Policy refresh. It takes no parameters:

```powershell
Invoke-LapsPolicyProcessing
```

Re-run the second query and look for a fresh 10004, since the cmdlet doesn’t report the outcome. If the password was past its expiry, the run also logs 10029 (or 10018) and then 10020.

### Reset-LapsPassword Is the Last Step

When cycles succeed but the password still hasn’t changed, rotate it by hand:

```powershell
Reset-LapsPassword
```

The cmdlet rotates the managed account’s password immediately, whether or not the current one has expired.

The [Reset-LapsPassword reference](https://learn.microsoft.com/en-us/powershell/module/laps/reset-lapspassword?view=windowsserver2025-ps) states: “This cmdlet is intended and recommended only for rare situations that require an immediate password rotation, for example as a response to a machine security breach situation.” Confirm with the third query, looking for a new 10029 or 10018 and then 10020.

* * *

_**Warning: Don’t attach Reset-LapsPassword to an automatic remediation for every overdue device. A blanket reset hides the failed backup or policy that caused the miss.**_

* * *

## Keep the Check Running

Unattended runs need an app registration with the `DeviceLocalCredential.ReadBasic.All` application permission, the [least-privileged choice](https://learn.microsoft.com/en-us/graph/api/directory-list-devicelocalcredentials?view=graph-rest-1.0) for this call. Replace the script’s first line, which signs in interactively, with an [app-only connection](https://learn.microsoft.com/en-us/powershell/microsoftgraph/app-only?view=graph-powershell-1.0):

```powershell
$clientId = '<app-registration-client-id>'
$tenantId = '<tenant-id>'
$thumbprint = '<certificate-thumbprint>'  # cert must be in Cert:\CurrentUser\My or Cert:\LocalMachine\My
Connect-MgGraph -ClientId $clientId -TenantId $tenantId -CertificateThumbprint $thumbprint
```

Then schedule the script from a CI job or [Task Scheduler task](https://adamtheautomator.com/powershell-scheduled-task/) whose failure raises an alert.

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fwindows-laps-password-rotation-powershell%2F&text=Stop%20Missed%20Windows%20LAPS%20Password%20Rotations%20with%20PowerShell)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fwindows-laps-password-rotation-powershell%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fwindows-laps-password-rotation-powershell%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b812193d4cc7a6d4be13d/1daf00385836df44b470b450d81ec18105c2ccff55f54f2fd2f72592fca6e34c.png)

### [Stop Impersonation: Verify Identity at Onboarding](/identity-verification-onboarding/)

Prevent impersonation by verifying identity during onboarding. Why identity proofing must happen before provisioning access to new hires.

![](https://adamtheautomator.com/wp-content/uploads/publisher/2e05d9c85b2b81c080b8d45ec1cdfbb3/71dd588b2369d52e1695c95c1493383c6c0ed2adb4aac7eba04c1ab324f3a6a6.webp)

### [Stop Service Principal Sprawl in Entra ID with PowerShell](/stop-service-principal-sprawl-entra-id-powershell/)

Inventory every app registration and service principal, then automate ownership, rotation, and safe disablement with PowerShell and Microsoft Graph.

![](https://adamtheautomator.com/wp-content/uploads/2026/08/featured_image.webp)

### [Entra PIM vs. Delinea vs. CyberArk: Don’t Buy the Wrong PAM](/entra-pim-vs-delinea-cyberark/)

Entra PIM grants roles; Delinea and CyberArk vault credentials. Compare scope, session recording, audit evidence, and three-year cost.

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)