Question

Contoso wants to secure the built-in local Administrator account on all Entra-joined Windows 11 devices. Security requires that each device use a unique local admin password that is automatically rotated every 30 days and backed up so that helpdesk staff can retrieve it when needed. You plan to use Windows LAPS managed through Microsoft Intune. Which configuration meets these requirements?

Accepted Answer

Create an Intune account protection policy for Windows LAPS with the backup directory set to Microsoft Entra ID and a password age of 30 days

Answer

Create an Intune account protection policy for Windows LAPS with the backup directory set to Active Directory and a password age of 30 days

Answer

Configure a Windows Hello for Business policy in Intune to rotate the local Administrator password every 30 days

Answer

Deploy a device compliance policy that marks devices noncompliant if the local Administrator password is older than 30 days