Lithnet Access Manager and Windows LAPS
Windows LAPS gives every Windows device its own local admin password. Lithnet Access Manager makes those passwords easy and safe for your team to use, wherever they are stored. Drop in the Access Manager server and every LAPS password is in one web app, behind your identity provider's MFA. Add the Access Manager agent and you get full control, with passwordless logon, passphrases from your own word lists and one agent for every operating system.
One web app for every LAPS password
Windows LAPS stores each password in Active Directory or in Microsoft Entra ID, depending on how the device is joined, so your team often ends up switching between consoles to find the right one. Install the Access Manager server and every one of those passwords is in the same mobile-friendly web app. Your team types a computer's name and gets its password, wherever it's stored.
They sign in through your identity provider, so your MFA and conditional access policies protect every password. Rate limits stop a stolen account from collecting passwords in bulk, and Access Manager records every request and can send it to your SIEM, email, Slack or Teams.
Choose your LAPS agent
Both agents give every device a unique admin password that rotates. The Access Manager server can read passwords from either agent, so you can use each one where it fits best.
| Feature | Windows LAPS | Access Manager agent |
|---|---|---|
| A unique admin password that rotates | Yes Microsoft Learn | Yes |
| Where passwords are stored | Active Directory or Microsoft Entra ID | Your Access Manager server |
| Password encryption | Optional for passwords stored in Active Directory Microsoft Learn | Every password is encrypted |
| Password history | Up to 12 previous passwords in Active Directory, only when encryption is on Microsoft Learn | You choose how many previous passwords to keep, and for how many days |
| Active Directory joined devices | Yes | Yes |
| Microsoft Entra joined devices | Yes | Yes |
| Standalone Windows devices | No Microsoft Learn | Yes |
| Windows Server 2016 | No Microsoft Learn | Yes |
| macOS | Intune has a separate macOS LAPS feature for Macs set up with Automated Device Enrollment after a factory reset Microsoft Learn | Yes |
| Linux | No Microsoft Learn | Yes |
| Universal policy management across all operating systems | No | Yes |
| LAPS passphrases | On Windows 11 24H2, Windows Server 2025 and later, using one of Microsoft's three fixed word lists Microsoft Learn | Passphrases from the built-in English word list or from word lists that you import, for example in another language |
The Access Manager agent also gives you
You can use these on any Windows device, even where Windows LAPS manages the password.
- RapidLAPS passwordless logon: scan a QR code at the logon screen, approve the request on your phone, and Windows logs you on as the local admin
- BitLocker recovery key backup from every Windows device to Access Manager
Get started today
Professional starts at USD 750 a year, including 100 devices and support from Lithnet.
The free trial unlocks every feature for 30 days on a free installation.