Direct answer
Verify that the intended local administrator account is covered by Windows LAPS, its password is backed up to the configured directory, rotation is working and only authorized support roles can retrieve it.
Map policy and devices
Identify the directory used for password backup, enrolled device groups, supported Windows versions and the account managed by policy. Compare a representative set of devices with the enrollment inventory. Microsoft describes Windows LAPS as a way to manage and back up a local administrator password on supported joined devices.
Reference: Microsoft: Windows LAPS overview.
Check rotation and backup evidence
Use the appropriate management console or LAPS event records to confirm recent successful processing, backup and expected rotation. An offline or unenrolled device may have stale data. Record state and timestamps only; do not copy the password into an assessment report.
Review retrieval permissions
Ask the identity owner to inspect who can read the recovery password and how access is logged. Test an authorized support workflow and verify that an unprivileged test role cannot retrieve it. Account for directory permissions and group nesting as well as console roles.
Exercise recovery and exceptions
With approval, test a controlled support scenario on a noncritical machine, including what happens when the device is offline. Track devices not processing policy and retain a tested recovery path. Plan migrations from older implementations separately because legacy and native policy behavior differ.
Reference: Microsoft: Windows LAPS overview.
Assessment limits
Windows LAPS depends on supported platforms, directory configuration, permissions and policy processing. Managing one local administrator password does not inventory all privileged accounts or prevent every form of lateral movement.
Frequently asked questions
Does LAPS manage every privileged account?
No. Check the configured managed account and review other local and directory privileges separately.
Should a report contain the managed password?
No. Preserve only the status, timestamps and restricted evidence reference needed to validate the review.
Does a configured policy prove every device has rotated?
No. Check processing and backup status for the actual devices, including offline and excluded systems.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.