How to Fix LAPS Password Not Displaying

Henry Zhang 0 Reputation points
2026-09-09T23:25:09.2533333+00:00

Some laptops with in org that have been provisioned with autopilot do not show laps password, but others do. What's the cause of this and what's the solution? Thank you.

Microsoft Security | Windows Autopilot
0 comments

1 answer

Sort by: Newest
Most helpful Newest Oldest

  1. AI answer

    2026-09-09T23:25:23.68+00:00

    A common cause in Windows Autopilot pre-provisioned deployments is a Windows LAPS warning during the technician phase. In that phase, Autopilot temporarily unjoins the device from Microsoft Entra, so the Windows LAPS CSP rejects MDM configuration and logs Event ID 20000. This is expected and should be ignored for pre-provisioning workflows. Windows LAPS becomes functional later in the user phase after the device is rejoined to Microsoft Entra, and only then does it start backing up passwords.

    If some Autopilot laptops still never show a LAPS password, check these areas:

    1. Verify whether the device used Autopilot pre-provisioning.
      • If yes, Event ID 20000 during technician flow is expected.
      • The password should appear only after the later user flow completes and the device is rejoined to Microsoft Entra.
    2. Check the Windows LAPS Operational log.
      • Open Event Viewer > Applications and Services Logs > Microsoft > Windows > LAPS > Operational.
      • If there are failures, use the event ID to narrow the cause.
    3. If Event ID 10028 appears, the device failed to update Microsoft Entra ID with the new password.
      • Verify Windows LAPS is enabled in the Azure tenant.
      • Verify the device is not deleted or disabled in Microsoft Entra ID.
      • Run dsregcmd /status and review Device status, SSO data, and Diagnostic data for errors.
    4. If Event ID 10032 appears, the device could not authenticate to Azure by using the device identity.
      • Check the same dsregcmd /status sections.
      • This points to Microsoft Entra device registration or authentication issues.
    5. If Event ID 10025 appears, Azure discovery failed.
      • Test connectivity to https://enterpriseregistration.windows.net in a browser. Getting Unsupported method or endpoint confirms connectivity.
      • If a proxy is used, verify the proxy is configured in system context with netsh winhttp show proxy.

    In short, the likely causes are:

    • expected temporary LAPS rejection during Autopilot pre-provisioning
    • device registration or authentication problems with Microsoft Entra
    • connectivity or proxy issues preventing Azure discovery
    • the device being disabled or deleted in Microsoft Entra

    The solution depends on the event log result, but for Autopilot pre-provisioning specifically, the fix is usually to let the user phase complete so the device rejoins Microsoft Entra and Windows LAPS can back up the password.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.