MP.RKS.IA.1002: Windows devices back up their local administrator password to Entra ID
| ID | MP.RKS.IA.1002 |
| Severity | High |
| Suite | RKSolutions Intune Anomalies |
| Product | Intune |
| Feature | Endpoint security |
| Security area | Devices and endpoints |
| Resource type | Device |
| User impact of fixing | Low |
| Effort to fix | Medium |
| Provides evidence for | CIS M365 v7.0.0: 5.1.4.5 (partial)ISO 27001:2022: A.8.2 (partial), A.5.17 (partial)UAE IA v1.1: T5.2.2 (partial), T5.5.3 (partial)What this means |
| MITRE ATT&CK | T1078.003, T1021 |
| Reads from | Microsoft Graph |
| Licence needed | INTUNE_A |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Every Windows device should back up the password of its local administrator account to Microsoft Entra ID with Windows LAPS, and do it regularly. Without LAPS, local admin passwords tend to be the same on every device, so one stolen password opens them all. A backup that is older than the rotation period means rotation has stalled.
The test lists devices without an Entra-backed LAPS policy, devices with a policy but no password in Entra ID, and
devices whose last backup is older than the MaximumBackupAgeDays parameter (60 days by default).
Remediation action
Section titled “Remediation action”- In the Microsoft Intune admin center, go to Endpoint security > Account protection.
- Assign a Local admin password solution (Windows LAPS) policy with Backup Directory set to Azure AD only.
- For a device with a policy but no backup, check in the device’s Device configuration status why the policy fails, and sync the device.
Related links
Section titled “Related links”Mito check, based on RKSolutions Intune Anomalies by Roy Klooster. Author: royklo. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.