Home active directory laps troubleshooting windows server

Troubleshooting Windows LAPS: Expert Guidance for Windows Server

Updated: • 0 • min read
Table of Contents

Windows Local Administrator Password Solution (Windows LAPS) is a crucial Windows feature designed to enhance security by automatically managing and backing up local administrator account passwords. This solution applies to devices joined to Microsoft Entra ID or Windows Server Active Directory. Additionally, Windows LAPS can manage and back up Directory Services Repair Mode (DSRM) account passwords on Windows Server Active Directory domain controllers, allowing authorized administrators to retrieve and utilize them as needed.

This comprehensive guide offers fundamental concepts and expert advice for effectively troubleshooting common issues encountered with Windows LAPS. Understanding the underlying mechanisms and typical error indicators is essential for maintaining a secure and smoothly operating environment.

Troubleshooting Windows LAPS

Troubleshooting Windows LAPS Using Windows Events

Windows LAPS meticulously logs its operations and any encountered issues within the Windows Event Viewer. This centralized logging provides an invaluable resource for diagnosing problems. To access these events, navigate to Applications and Services Logs > Microsoft > Windows > LAPS > Operational in Event Viewer. Reviewing these logs should always be the first step in any troubleshooting endeavor.

Windows LAPS primarily operates in two distinct scenarios, each with its own set of considerations:

  • Windows LAPS Active Directory: In this configuration, client machines are set up to store the managed local administrator password directly within Active Directory. This scenario is typically used in traditional on-premises environments.
  • Windows LAPS Microsoft Entra ID: For devices joined to Microsoft Entra ID (formerly Azure Active Directory), client machines are configured to store the password in the cloud-based directory service. This supports modern, cloud-centric IT infrastructures.

The table below lists various event IDs logged by Windows LAPS, indicating the scenario in which they typically occur. These event IDs serve as specific indicators of different problems that may arise during the LAPS operation.

Event ID Scenario
10006 Windows LAPS Active Directory
10011 Windows LAPS Active Directory
10012 Windows LAPS Active Directory
10013 Windows LAPS Active Directory and Microsoft Entra ID
10017 Windows LAPS Active Directory
10019 Windows LAPS Active Directory and Microsoft Entra ID
10025 Windows LAPS Microsoft Entra ID
10026 Windows LAPS Microsoft Entra ID
10027 Windows LAPS Active Directory and Microsoft Entra ID
10028 Windows LAPS Microsoft Entra ID
10032 Windows LAPS Microsoft Entra ID
10034 Windows LAPS Active Directory
10035 Windows LAPS Active Directory
10048 Windows LAPS Active Directory and Microsoft Entra ID
10049 Windows LAPS Active Directory and Microsoft Entra ID
10056 Windows LAPS Active Directory
10057 Windows LAPS Active Directory
10059 Windows LAPS Microsoft Entra ID
10065 Windows LAPS Active Directory

Event ID 10006

LAPS password encryption is required but the Active Directory domain is not yet at 2016 domain functional level. The password was not updated and no changes will be made until this is corrected

Explanation

This event indicates that Windows LAPS is configured to encrypt the managed account’s password on the client machine, a default and recommended security measure. However, this encryption feature necessitates that your Active Directory domain’s functional level be at least Windows Server 2016. If the domain functional level is lower, the encryption process cannot proceed, and LAPS will fail to update the password.

Resolution

There are two primary approaches to resolve Event ID 10006, depending on your environment and security requirements:

Option 1: Raise Domain Functional Level

The recommended solution is to raise the domain functional level of your Active Directory forest to Windows Server 2016 or higher. This action ensures full support for LAPS password encryption and other modern Active Directory features. Before raising the functional level, ensure all domain controllers in your environment are running an operating system version compatible with Windows Server 2016 or newer.

As an alternative, you can disable the Enable password encryption Group Policy setting for your client machines. While this allows LAPS to function in a domain with a lower functional level, it means passwords stored in Active Directory will not be encrypted. It is strongly advised against disabling password encryption on domain controllers due to the significant security implications. Only consider this option as a temporary measure if upgrading your domain functional level is not immediately feasible.

Event ID 10011

LAPS failed when querying Active Directory for the current computer state

Explanation

Windows LAPS clients are designed to periodically query Active Directory to ascertain the current computer state, typically on an hourly basis. This process relies on the Netlogon service to discover and communicate with a suitable domain controller. If the client machine cannot successfully discover or connect to a domain controller, this event will be logged, indicating a communication breakdown that prevents LAPS from performing its tasks.

Resolution

Troubleshooting Event ID 10011 often involves verifying network connectivity and service health between the client machine and its domain controllers.

Ensure that necessary network ports are open between the client machine and the domain controllers. This is especially critical in environments with strict firewall rules or where connectivity is limited to specific writable domain controllers. Key ports for Active Directory communication include TCP/UDP 389 (LDAP), TCP/UDP 445 (SMB/Netlogon), TCP 88 (Kerberos), and others as detailed in the Windows Service overview and network port requirements documentation. Verify that no firewalls, either local or network-based, are impeding this communication.

Event ID 10012

The Active Directory schema has not been updated with the necessary LAPS attributes

Explanation

For Windows LAPS to store and manage passwords in Active Directory, specific attributes must be present in the Active Directory schema. This event signifies that these essential schema extensions are missing. This can occur for several reasons, including:

  • Root Cause 1: Schema Not Extended: The Update-LapsADSchema PowerShell cmdlet, or Update-AdmPwdADSchema for legacy LAPS emulation, has not been executed.
  • Root Cause 2: Transient Replication Latency: The schema changes, though applied to the schema master, have not yet fully replicated to the local domain controller that the client machine is communicating with.
  • Root Cause 3: Active Directory Replication Issues: There are broader replication problems within the Active Directory forest, preventing the schema updates from reaching the necessary domain controllers.

Resolution to Root Cause 1

To address a missing schema extension, run the appropriate PowerShell cmdlet with Schema Admin privileges. For modern Windows LAPS, execute Update-LapsADSchema. If you are specifically implementing Windows LAPS in a legacy LAPS emulation mode, and the legacy LAPS product is installed, use the Update-AdmPwdADSchema cmdlet. Confirm the command completes successfully before proceeding.

Resolution to Root Cause 2

If schema attributes are not visible due to replication latency, you can use tools like LDP.exe or ADSIEdit.msc to verify their presence on the local domain controller. To expedite the process, force Active Directory replication of the schema partition from the schema master. Use the repadmin /replicate command, specifying the local DC, the PDC (as schema master), and the schema partition’s distinguished name. For example:

repadmin /replicate DC2.contoso.com PDC.contoso.com CN=Schema,CN=Configuration,DC=contoso,dc=com /force

This command will force the replication of schema changes from the Primary Domain Controller (PDC) to the specific local domain controller.

Resolution to Root Cause 3

For underlying Active Directory replication issues, examine Event ID 10055 in the Windows LAPS event logs to identify the domain controller involved. Then, use the repadmin /showreps command on that domain controller to detect any replication errors. Comprehensive troubleshooting of Active Directory replication problems typically involves checking DNS, network connectivity, and the health of the replication topology. Refer to Microsoft’s documentation on troubleshooting Active Directory replication for detailed steps.

Event ID 10013

LAPS failed to find the currently configured local administrator account

Explanation

Windows LAPS needs to identify a specific local administrator account to manage its password. The name of this account is typically configured through Group Policy or an Intune setting, specifically “Name of administrator account to manage.” If this setting is not defined, Windows LAPS defaults to searching for the built-in local administrator account, which has a Security Identifier (SID) ending with -500. If Windows LAPS cannot locate the designated account, this event ID 10013 is logged.

It is important to note that for Windows versions prior to Windows 11, version 24H2, and Windows Server 2025, the managed account must already exist on the client machine. Newer versions include a feature to automatically create the managed user if it’s missing, as detailed in the Windows LAPS account management modes documentation.

Resolution

To resolve Event ID 10013, you must ensure that the managed local administrator account exists on the client machine and that its name matches the configuration.

Verify the presence of the managed user in local users using one of the following methods:

  1. Local Users and Groups (lusrmgr.msc): Open lusrmgr.msc and inspect the “Users” folder to confirm the account’s existence and exact spelling.
  2. Command Prompt (net user): Run the command net user in an elevated command prompt. This will list all local user accounts. Double-check the account name specified in your LAPS configuration (Group Policy or Intune) against the list. Pay close attention to any leading or trailing spaces in the configured account name, as these can prevent LAPS from finding the account.

If the account is missing, create it manually or through an automated process, ensuring its name precisely matches the LAPS configuration.

Event ID 10017

LAPS failed to update Active Directory with the new password. The current password has not been modified

Explanation

Event ID 10017 is a high-level status event indicating that the Windows LAPS processing cycle concluded without successfully updating the password in Active Directory. This event itself does not specify a root cause; rather, it signifies that an earlier issue prevented the update. Therefore, to troubleshoot this event, you must investigate the preceding LAPS events that occurred during the same processing cycle.

Resolution

To diagnose the underlying cause of Event ID 10017, follow these steps:

  1. Initiate a manual LAPS policy processing cycle. Open an elevated PowerShell command prompt and run Invoke-lapsPolicyProcessing. This forces the client to attempt a password update immediately.
  2. Access the Windows LAPS operational logs by navigating to Applications and Services Logs > Microsoft > Windows > LAPS > Operational in Event Viewer.
  3. Filter the event logs to display events from the most recent processing cycle. Look for events starting from Event ID 10003 through Event ID 10005, which typically mark the beginning of a LAPS operation. Carefully examine all events occurring before Event ID 10017.
  4. Identify and address any specific error events logged prior to Event ID 10017. These preceding events will provide the actual reason for the password update failure. For example, issues with schema, permissions, or domain controller connectivity would appear as earlier event IDs.

Event ID 10019

LAPS failed to update the local admin account with the new password

Explanation

This event signifies that while Windows LAPS successfully identified the locally managed user account on the client machine, it encountered an obstacle when attempting to change that account’s password. The issue isn’t with finding the account, but with the actual password modification operation itself. This could stem from resource constraints or conflicts with other software.

Resolution

Troubleshooting Event ID 10019 requires investigating potential resource conflicts or interference from third-party applications.

  1. Resource Issues: First, determine if the machine is experiencing resource-related problems, such as a memory leak or an out-of-memory condition. A simple reboot of the machine can often resolve transient resource issues. If the error persists after a reboot, further investigation into system performance and resource utilization is warranted.
  2. Third-Party Interference: A common cause for this event is interference from third-party applications or filter drivers that also attempt to manage or monitor local user accounts and their passwords. Such software might block Windows LAPS from modifying the password. Review recently installed applications, security software, or any tools that manage local accounts. Temporarily disabling or uninstalling suspect applications can help isolate the cause.

Event ID 10025

Azure discovery failed

Explanation

For devices configured with Windows LAPS to store passwords in Microsoft Entra ID (either Microsoft Entra joined or hybrid joined), the device must successfully discover the Microsoft Entra Enterprise Registration Endpoint (https://enterpriseregistration.windows.net). This endpoint is crucial for the device to communicate with Microsoft Entra ID and perform registration and authentication tasks. If the discovery process fails, LAPS cannot proceed with its operations.

Resolution

To resolve Event ID 10025, focus on network connectivity and proxy configurations for Microsoft Entra ID communication.

  1. Endpoint Connectivity Test: Verify that the client machine can successfully connect to the Microsoft Entra Enterprise Registration Endpoint. You can perform a basic test by attempting to access https://enterpriseregistration.windows.net in a web browser (e.g., Microsoft Edge or Google Chrome). A message like “Unsupported method or endpoint” indicates that connectivity to the endpoint is working, even though a browser cannot directly interact with it. If you cannot reach the endpoint, investigate network issues, firewalls, or internet access problems.
  2. Proxy Server Configuration: If your environment uses a proxy server, ensure that the proxy is correctly configured within the system context. Windows services, including LAPS, often run under the system account and rely on system-wide proxy settings. To check the system proxy, open an elevated command prompt and run netsh winhttp show proxy. If a proxy is configured but incorrect, or if no proxy is configured but required, adjust the settings accordingly using netsh winhttp set proxy.

Event ID 10026

LAPS was unable to authenticate to Azure using the device identity

Explanation

This event indicates that the Windows LAPS client failed to authenticate to Microsoft Entra ID using the device’s identity. This authentication relies heavily on the device’s Primary Refresh Token (PRT), which is essential for establishing a secure and continuous session with Microsoft Entra ID. Issues with the device’s PRT, its registration status, or the overall health of its Microsoft Entra ID join can lead to this authentication failure.

Resolution

Troubleshooting Event ID 10026 involves verifying the Microsoft Entra ID tenant configuration, device status, and PRT health.

  1. Enable Windows LAPS Feature: Confirm that the Windows LAPS feature has been explicitly enabled within your Microsoft Entra tenant settings. Without this tenant-level configuration, device-based authentication for LAPS will fail.
  2. Device Status in Microsoft Entra ID: In the Microsoft Entra admin center, verify that the device is not deleted or disabled. A disabled or removed device cannot authenticate successfully.
  3. Device State (dsregcmd /status): Open a command prompt on the client machine and run dsregcmd /status. Carefully examine the following sections for any errors or unexpected statuses:
    • Device status: Check AzureAdJoined, DomainJoined (for hybrid), DeviceState.
    • SSO data: Look for AzureAdPrt status and PrtLastUpdate to ensure the PRT is valid and current.
    • Diagnostic data: This section often provides specific error codes or messages that can guide further troubleshooting.
  4. Troubleshoot dsregcmd Errors: Refer to Microsoft’s documentation on dsregcmd command errors for detailed explanations and troubleshooting steps related to any specific issues identified.
  5. Hybrid Join Troubleshooting: If the device is Microsoft Entra hybrid joined, consult the troubleshooting guide for Microsoft Entra hybrid joined devices to address any synchronization or registration problems between on-premises Active Directory and Microsoft Entra ID.
  6. Device Registration Troubleshooter Tool: Utilize the Device Registration Troubleshooter Tool (dsregtool) to automatically identify and attempt to fix common device registration and authentication issues.
  7. Microsoft Entra Authentication Error Codes: If specific error codes are found in the dsregcmd output or Microsoft Entra ID logs, cross-reference them with the Microsoft Entra authentication and authorization error codes documentation for detailed descriptions and suggested resolutions.

Event ID 10027

LAPS was unable to create an acceptable new password. Please verify that the LAPS password length and complexity policy is compatible with the domain and local password policy settings

Explanation

This event signifies that Windows LAPS successfully identified the local administrator account to manage but failed to generate or set a new password because the generated password or the LAPS policy itself conflicts with other password policies enforced on the machine. This can include local security policies, domain-level Group Policy Objects (GPOs), or third-party password filters that impose stricter or incompatible requirements for password complexity, length, or age.

Resolution

To resolve Event ID 10027, you must identify and reconcile conflicting password policies or third-party interference.

  1. Check Local Password Policy: Open a command prompt and run net accounts. Review the output for password policy settings such as minimum password length, complexity requirements, and password age. Compare these settings with the Windows LAPS password policy configured via Group Policy or Intune (MDM) in the “Password Settings” section. Ensure that the LAPS policy settings are compatible with or meet the requirements of the local and domain policies. For example, if LAPS is set to generate an 8-character password, but a local policy requires 10 characters, a conflict will arise.
  2. Identify Policy Source: Determine whether the conflicting password policy is applied via a Local Group Policy Object (LGPO), a Domain GPO, or Local Security Settings. Run GPRESULT /h C:\gpresult.html in an elevated command prompt and open the generated HTML report. Analyze the “Password Policy” section to identify the source and specific settings of all applied policies. Adjust the conflicting GPO or security settings to align with or be less restrictive than the Windows LAPS password settings. It is critical that your Active Directory, local GPO, or security settings password policies are compatible and do not impose stricter requirements than your Windows LAPS configuration.
  3. Check for Third-Party Password Filters: Third-party password filters can block Windows LAPS from setting passwords. These are often DLLs loaded into the Local Security Authority Subsystem Service (LSASS.exe) process.
    • Download and extract Process Explorer.
    • Run Process Explorer as an administrator.
    • In the upper pane, select the LSASS.exe process.
    • Go to View > Show Lower Pane, then View > Lower Pane View > DLLs.
    • Examine the list of loaded DLLs or modules in the lower pane. Look for entries where the “Company Name” is not “Microsoft.” Pay particular attention to DLL names containing keywords like “security,” “password,” or “policies.” If you identify a suspect third-party module, research the associated application or service and consider temporarily disabling or uninstalling it to test if the issue resolves.

Machine Joined to Microsoft Entra ID

For Microsoft Entra ID joined or hybrid joined devices, password policies can also be influenced by Mobile Device Management (MDM) solutions like Intune, in addition to local GPOs.

  1. Check Local Password Policy: Similar to Active Directory-joined machines, run net accounts in a command prompt to review local password policies (length, complexity, age) and compare them with the Windows LAPS password policy configured via Intune.
  2. Identify Conflicting MDM Policies: If using Intune or similar third-party MDM software, examine the device configuration profiles applied to the machine. Ensure that no MDM policy overrides or conflicts with the password settings configured for Windows LAPS. Adjust the MDM policy as necessary to ensure compatibility.

Event ID 10028

LAPS failed to update Azure Active Directory with the new password

Explanation

This event indicates that the Windows LAPS client machine, configured to store passwords in Microsoft Entra ID, was unable to successfully update the managed account’s password to the directory. This is a critical failure in the LAPS operational cycle for Microsoft Entra ID-managed devices. The inability to update the password can stem from various issues, including connectivity problems, authentication failures, or problems with the device’s registration status in Microsoft Entra ID.

Resolution

Resolving Event ID 10028 requires a thorough check of the device’s connection and authentication with Microsoft Entra ID, as well as its overall health status.

  1. Enable Windows LAPS Feature: Confirm that the Windows LAPS feature is activated within your Microsoft Entra tenant settings. This is a prerequisite for any LAPS operations with Microsoft Entra ID.
  2. Device Status in Microsoft Entra ID: Verify in the Microsoft Entra admin center that the device has not been deleted or disabled. A device that is not active in Microsoft Entra ID cannot update its password.
  3. Device State (dsregcmd /status): Open a command prompt on the client machine and execute dsregcmd /status. Pay close attention to the following sections for any anomalies or errors:
    • Device status: Check the overall state of the device’s join.
    • SSO data: Look for the status of the Primary Refresh Token (PRT).
    • Diagnostic data: Any specific error codes or messages here are crucial for diagnosis.
  4. Troubleshoot dsregcmd Errors: Consult the Microsoft documentation on dsregcmd command errors for detailed explanations and troubleshooting guidance specific to any issues identified in the output.
  5. Hybrid Join Troubleshooting: For Microsoft Entra hybrid joined devices, refer to the troubleshooting guide for Microsoft Entra hybrid joined devices to address any potential synchronization or registration issues affecting the device’s ability to communicate with Microsoft Entra ID.
  6. Device Registration Troubleshooter Tool: Use the Device Registration Troubleshooter Tool to help diagnose and resolve common device registration problems that could impede LAPS functionality.
  7. Microsoft Entra Authentication Error Codes: If you encounter specific error codes in the dsregcmd output or Microsoft Entra ID logs, look them up in the Microsoft Entra authentication and authorization error codes reference for detailed descriptions and recommended solutions.

Event ID 10032

LAPS was unable to authenticate to Azure using the device identity

Explanation

Event ID 10032 is essentially a reconfirmation of authentication failures experienced by Windows LAPS when trying to communicate with Microsoft Entra ID. Similar to Event ID 10026, this error points to issues with the device’s Primary Refresh Token (PRT) and its ability to establish a trusted authentication context with Microsoft Entra ID. Without proper device identity-based authentication, LAPS operations cannot proceed.

Resolution

The troubleshooting steps for Event ID 10032 are identical to those for Event ID 10026, as both events indicate a failure in device identity-based authentication to Microsoft Entra ID.

  1. Enable Windows LAPS Feature: Ensure that the Windows LAPS feature is enabled within your Microsoft Entra tenant.
  2. Device Status in Microsoft Entra ID: Verify that the machine is not deleted or disabled within your Microsoft Entra tenant.
  3. Device State (dsregcmd /status): Run dsregcmd /status in an elevated command prompt on the client. Examine the Device status, SSO data, and Diagnostic data sections for any errors or warnings.
  4. Troubleshoot dsregcmd Errors: Use the Microsoft documentation for dsregcmd command errors to interpret and resolve any specific issues.
  5. Hybrid Join Troubleshooting: For Microsoft Entra hybrid joined devices, refer to the relevant troubleshooting guide to address hybrid join specific issues.
  6. Device Registration Troubleshooter Tool: Employ the Device Registration Troubleshooter Tool to diagnose and fix device registration problems.
  7. Microsoft Entra Authentication Error Codes: If specific error codes are present, consult the Microsoft Entra authentication and authorization error codes documentation for detailed explanations and resolution steps.

Event ID 10034

The configured encryption principal is an isolated (ambiguous) name. This must be corrected before the configured account's password can be managed. Please specify the name in either user@domain.com or domain\user format.

Explanation

This event occurs when the “Configure authorized password decryptors” setting, managed via Group Policy or MDM (Intune), is improperly configured. This setting dictates which users or groups are authorized to retrieve the LAPS-managed passwords. The error message indicates that the specified principal name is ambiguous or in an incorrect format, making it impossible for Windows LAPS to resolve it to a valid security principal. Windows LAPS requires the principal to be specified in a clear, unambiguous format such as user@domain.com or domain\user.

Resolution

To resolve Event ID 10034, you must correct the format of the encryption principal specified in your Group Policy or Intune configuration.

The “Configure authorized password decryptors” setting accepts two valid formats:

  • Security Identifier (SID): The SID of a domain group or user.
  • Domain Name Format: The group or user name in one of the following clear formats: <Domain Name>\<Group Name>, <Domain Name>\<User Name>, or <User Name>@<Domain Name>.

Carefully review your GPO or Intune settings for this policy. Ensure that the name is provided in one of the specified unambiguous formats. Crucially, verify that there are no leading or trailing spaces around the name in the configuration, as these can cause resolution failures. For example, contoso\lapsadmin is correct, whereas contoso\lapsadmin (with spaces) is not.

Event ID 10035

The configured encryption principal name could not be mapped to a known account. This must be corrected before the configured account's password can be managed.

Explanation

This event is closely related to Event ID 10034. It also pertains to the “Configure authorized password decryptors” setting. However, instead of a formatting issue, Event ID 10035 indicates that while the format might be correct (e.g., Domain\User), Windows LAPS cannot resolve the provided name or SID to an actual, existing security principal in Active Directory. This often happens if the specified group or user account has been deleted, if there are Active Directory replication issues preventing the client from seeing the account, or if there are DNS resolution problems.

Resolution

To resolve Event ID 10035, you need to verify the existence and resolvability of the configured encryption principal.

  1. Verify Group/User Existence: Confirm that the domain group or user specified in the “Configure authorized password decryptors” setting actually exists in Active Directory and has not been deleted or renamed. Use Active Directory Users and Computers to search for the principal.
  2. Active Directory Replication Latency: If the group or user was recently created, there might be replication latency. Wait for Active Directory replication to converge across your domain controllers, especially to the local domain controller that the client machine is communicating with. You might force replication if necessary (refer to Resolution to Root Cause 2 for Event ID 10012).
  3. Manual SID/Name Resolution (PsGetSid): Use the Sysinternals tool PsGetSid to manually attempt to resolve the SID to a name, or a name to an SID, directly from the client machine experiencing the issue.
    • Download and extract PsGetSid.
    • Open an elevated command prompt on the client machine.
    • Run psgetsid -accepteula <SID or Name> using the SID or name mentioned in Event ID 10035. If PsGetSid fails to resolve the principal, it points to a fundamental directory services issue.
  4. Troubleshoot Active Directory Replication: Check for any ongoing Active Directory replication errors across your forest. Replication issues can prevent client machines from correctly resolving security principals. Use tools like dcdiag and repadmin /showrepl to identify and troubleshoot replication problems. Refer to Microsoft’s documentation on troubleshooting Active Directory Replication Problems for comprehensive guidance.

Event ID 10048

The currently pending post-authentication reset timer has been retried the maximum allowed number attempts and will no longer be scheduled

Explanation

Windows LAPS includes a mechanism for post-authentication actions, such as resetting the password after a local administrator logs in using the LAPS-managed account. If a password reset is pending, LAPS attempts to perform this action. Event ID 10048 indicates that LAPS has attempted this post-authentication password reset a maximum number of times (defaulting to 100 retries) without success and will no longer schedule further attempts until the underlying issue is resolved. This signifies a persistent problem preventing LAPS from completing its designated post-authentication task.

Resolution

Resolving Event ID 10048 requires identifying and addressing the root cause that prevented the post-authentication password reset.

  1. Directory Connectivity Issues: The most common reason for this event is a problem connecting to the appropriate directory service (Active Directory or Microsoft Entra ID) to perform the password reset. Verify network connectivity to your domain controllers or Microsoft Entra ID endpoints. Check for DNS resolution issues, firewall blocks, or general network outages that might be preventing the client from communicating with the directory.
  2. Troubleshoot Other LAPS Errors: This event is typically a symptom of another, more fundamental LAPS processing error. Review earlier Windows LAPS events (prior to 10048) in the Event Viewer for specific errors that would explain why the password reset failed. For example, if there were issues authenticating to the directory (Event ID 10026, 10032) or if the password policy prevented an acceptable new password (Event ID 10027), these would also prevent the post-authentication reset. Address any other LAPS error events you discover during your investigation.

Event ID 10049

LAPS attempted to reboot the machine as a post-authentication action but the operation failed

Explanation

Windows LAPS can be configured to perform a post-authentication action, such as rebooting the machine, after a specific event (e.g., a password reset). This setting is configured via the “Post-authentication actions” policy in Group Policy or Intune. Event ID 10049 is logged when LAPS attempts to initiate this configured reboot but fails to do so. This can happen due to various reasons, including conflicting applications blocking the shutdown, insufficient user privileges, or pending system updates that prevent an immediate reboot.

Resolution

To resolve Event ID 10049, focus on identifying any factors that might prevent a system reboot.

  1. Application Interference: Determine if any applications running on the machine are actively blocking a shutdown or reboot. Some applications (e.g., those with unsaved work or critical processes) can prompt users before closing, which might prevent an automated reboot. Check system logs for shutdown blockers. Temporarily closing unnecessary applications or services can help isolate this issue.
  2. User Privileges: Ensure that the account under which Windows LAPS operates has the necessary privileges to initiate a system shutdown and reboot. Although LAPS usually runs under the system context, which has high privileges, ensure no security policies or settings explicitly restrict this action. Review Local Security Policy or GPOs related to user rights assignment for “Shut down the system” and “Force shutdown from a remote system.”

Event ID 10056

LAPS failed to locate a writable domain controller

Explanation

For Windows LAPS to store managed passwords in Active Directory, the client machine must be able to perform an LDAP modify operation to write data to a domain controller. This requires discovering and establishing a connection to a writable domain controller within the domain. Event ID 10056 is logged when the LAPS client cannot locate or connect to a domain controller that allows write operations, effectively blocking the password update process.

Resolution

To resolve Event ID 10056, you need to ensure proper discovery and connectivity to a writable domain controller.

  1. Verify Writable DC Discovery: On the client machine, open an elevated command prompt and run the following command to test for writable domain controller discovery:
    nltest /dsgetdc:<Domain Name> /force /writable

    Replace <Domain Name> with your actual domain name (e.g., contoso.com). If this command returns “error 1355” (domain controller for the domain cannot be found) or fails to identify a writable DC, it indicates a fundamental problem with domain controller discovery. Troubleshoot this issue by checking DNS resolution for domain controllers, SRV records, and overall network connectivity.
  2. Network Port Requirements: Ensure all necessary network ports are open between the client machine and its domain controllers. This is particularly important in environments with strict network segmentation or firewalls. Key ports for LDAP, Kerberos, and Netlogon services (e.g., TCP/UDP 389, TCP 88, TCP/UDP 445) must be accessible. Refer to the “Service overview and network port requirements for Windows” documentation for a comprehensive list.

Event ID 10057

LAPS was unable to bind over LDAP to the domain controller with an <Error Code>:

Explanation

Event ID 10057 indicates an Active Directory authentication issue occurring when Windows LAPS attempts to bind over LDAP to a domain controller. This usually happens during a scheduled background processing cycle, where LAPS tries to connect to a domain controller using the machine’s context. The included <Error Code> provides more specific details about the LDAP binding failure, often pointing to issues with the machine account’s credentials or its secure channel to the domain.

Resolution

To resolve Event ID 10057, focus on the machine’s account health and secure channel status within Active Directory.

  1. Machine Account Existence: Verify that the client machine’s computer account still exists in Active Directory and has not been accidentally deleted, disabled, or moved to an inaccessible organizational unit (OU) without appropriate permissions.
  2. Secure Channel Validation: Validate the secure channel between the client machine and its domain controller. A secure channel is a communication link used by domain members to authenticate with domain controllers. Open an elevated command prompt and run the following command:
    nltest /sc_query:<Domain Name>

    Replace <Domain Name> with your domain. A successful output will show “The command completed successfully” and details about the secure channel. If it reports an error (e.g., “The secure channel to the DC is broken”), proceed to the next step.
  3. Rejoin Machine to Domain: If the secure channel is compromised, the most effective resolution is to rejoin the machine to the domain.
    • Crucial Note: Before initiating a domain rejoin, ensure you have the current local administrator password (or the LAPS-managed one if accessible) or a separate, known local account. If you lose domain access and cannot log in locally, you might face significant recovery challenges.
    • Disconnect the machine from the domain, then rejoin it. This process resets the machine’s secure channel and often resolves underlying authentication issues.

Event ID 10059

Azure returned a failure code

Explanation

This event indicates that during communication with Microsoft Entra ID (either connecting, authenticating, or updating the password), Microsoft Entra ID returned a specific failure code, often an HTTP error. This is a general error that signals a problem at the Microsoft Entra ID service level or with the client’s ability to interact with it successfully. The accompanying HTTP error code is crucial for narrowing down the exact nature of the failure.

Resolution

Troubleshooting Event ID 10059 is similar to other Microsoft Entra ID related LAPS events, with an emphasis on the specific HTTP failure code.

  1. Endpoint Connectivity: Verify successful connectivity from the client machine to the Microsoft Entra registration endpoint (https://enterpriseregistration.windows.net). As before, a browser test showing “Unsupported method or endpoint” confirms basic reachability.
  2. Enable Windows LAPS Feature: Confirm that the Windows LAPS feature is enabled within your Microsoft Entra tenant settings.
  3. Device Status in Microsoft Entra ID: Check the Microsoft Entra admin center to ensure the device is not deleted or disabled.
  4. Device State (dsregcmd /status): Open a command prompt and run dsregcmd /status. Examine the Device status, SSO data, and Diagnostic data sections for any errors that could point to the cause of the failure.
  5. Troubleshoot dsregcmd Errors: Refer to Microsoft’s documentation on dsregcmd command errors for detailed guidance based on any specific issues found.
  6. Hybrid Join Troubleshooting: For Microsoft Entra hybrid joined devices, consult the troubleshooting guide for Microsoft Entra hybrid joined devices to resolve any hybrid join specific issues that might interfere with Microsoft Entra ID communication.
  7. Device Registration Troubleshooter Tool: Use the Device Registration Troubleshooter Tool to diagnose and fix device registration problems.
  8. Microsoft Entra Authentication Error Codes: The most critical step here is to identify the specific HTTP error code returned by Azure (often present in the event details) and cross-reference it with the Microsoft Entra authentication and authorization error codes documentation. This will provide precise information about the failure and direct you to the appropriate troubleshooting steps.

Event ID 10065

LAPS received an LDAP_INSUFFICIENT_RIGHTS error trying to update the password using the legacy LAPS password attribute. You should update the permissions on this computer's container using the Update-AdmPwdComputerSelfPermission cmdlet, for example:

Explanation

Event ID 10065 indicates a permissions issue where the Windows LAPS client machine attempts to write the managed password to Active Directory but is denied due to “LDAP_INSUFFICIENT_RIGHTS.” This specifically points to missing “Self Permission” on the computer account. For a computer to update its own password attributes in Active Directory, it requires explicit self-permission to write to certain attributes (e.g., ms-Mcs-AdmPwd for legacy LAPS or msLAPS-Password for modern LAPS, along with msLAPS-ExpirationTime). This error commonly arises if the permissions were never set or if the computer object was moved to a different Organizational Unit (OU) where the required self-permission was not inherited or explicitly applied.

Resolution

To resolve Event ID 10065, you must ensure the computer account has the necessary self-permission to write LAPS attributes in Active Directory.

  1. Assign Self Permission: If the computer account has not been granted the “Self Permission” to write LAPS attributes, you must run the appropriate PowerShell cmdlet. For modern Windows LAPS, use Set-LapsADComputerSelfPermission:

    Set-LapsADComputerSelfPermission -Identity <OU Name>

    For example, if your computer objects are in an OU named “LAPSOU,” the command would be:
    Set-LapsADComputerSelfPermission -Identity LAPSOU

    You can also use a distinguished name (DN) for the OU, which is useful if you have OUs with identical names in different parts of your Active Directory hierarchy:
    Set-LapsADComputerSelfPermission -Identity OU=LAPSOU,DC=contoso,DC=Com

    This cmdlet grants the necessary permissions to all computer objects within the specified OU.

  2. Verify Computer Self-Permission: After running the cmdlet, or if you suspect a permissions issue, verify that the computer account indeed has the “Self Permission” on the Organizational Unit (OU) where the machine account resides. You can do this using Active Directory Users and Computers by enabling “Advanced Features,” then viewing the security permissions of the OU and checking for entries related to “Self” or “Authenticated Users” with write permissions on the LAPS-specific attributes. Ensure these permissions are inherited by computer objects. If a computer was moved to a new OU, these permissions might need to be reapplied or inherited correctly.

Windows LAPS is a powerful tool for enhancing security, but like any complex system, it requires careful configuration and troubleshooting. By systematically addressing these common event IDs and their resolutions, administrators can maintain a robust and secure environment for managing local administrator passwords.

Do you have any further questions about these events or specific scenarios in your environment? Your feedback and experiences are valuable!

Post a Comment