# Windows Cloud LAPS policy is created and assigned
Without enforcing Local Administrator Password Solution (LAPS) policies, threat actors who gain access to endpoints can exploit static or weak local…
Source: https://maester.dev/docs/tests/ZTA.24560
## Overview
Without enforcing Local Administrator Password Solution (LAPS) policies, threat actors who gain access to endpoints can exploit static or weak local administrator passwords to escalate privileges, move laterally, and establish persistence. The attack chain typically begins with device compromise—via phishing, malware, or physical access—followed by attempts to harvest local admin credentials. Without LAPS, attackers can reuse compromised credentials across multiple devices, increasing the risk of privilege escalation and domain-wide compromise.
Enforcing Windows LAPS on all corporate Windows devices ensures unique, regularly rotated local administrator passwords. This disrupts the attack chain at the credential access and lateral movement stages, significantly reducing the risk of widespread compromise.
## Remediation
Use Intune to enforce Windows LAPS policies that rotate strong and unique local admin passwords, and that back them up securely:
- [Deploy Windows LAPS policy with Microsoft Intune](https://learn.microsoft.com/intune/device-security/laps/deploy-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-a-laps-policy)
For more information, see:
- [Windows LAPS policy settings reference](https://learn.microsoft.com/windows-server/identity/laps/laps-management-policy-settings?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
- [Learn about Intune support for Windows LAPS](https://learn.microsoft.com/intune/device-security/laps/overview?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Devices |
| Category | Device management |
| Product | [Intune](/docs/tests/products/intune) |
| Feature | Endpoint security |
| Area | Privileged access |
| ATT&CK | [T1078.003](/docs/tests?mitre=T1078.003) Local Accounts, [T1021](/docs/tests?mitre=T1021) Remote Services |
| Licence | Intune |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.