Microsoft Intune Autopilot and Windows LAPS Deployment Guide

This guide documents the complete process for deploying Windows devices via Autopilot with integrated Windows LAPS password management. All configurations have been lab-verified on Windows 11 25H2 in a pure Azure AD/Entra joined environment.

The guide covers tenant configuration from scratch, custom local administrator account naming, passphrase-based passwords, BitLocker key escrow, and troubleshooting common policy conflicts.

Prerequisites and Licensing

Before configuring Autopilot, LAPS, or BitLocker, the tenant must have appropriate licensing. Missing licenses cause silent failures during OOBE deployment.

Microsoft 365 Business Premium, E3, E5, or Enterprise Mobility + Security E3/E5 bundles include all required components.

Administrator Role Requirements

Tenant Configuration from Zero

When onboarding a system to a tenant that may not have correct groups and configuration, execute these steps in sequence.

Verify MDM Authority

Navigate to Intune admin center > Tenant administration > Tenant status and verify MDM authority shows “Microsoft Intune”.

Configure Automatic MDM Enrollment

Path: Intune admin center > Devices > Enrollment > Windows > Automatic Enrollment

For White Glove deployments, ensure the technician account is included in the MDM user scope.

Configure Entra ID Device Settings

Path: Microsoft Entra admin center > Identity > Devices > Device settings

The LAPS tenant setting must be enabled before deploying LAPS policies. Policies fail silently if this is not configured.

Dynamic Group Configuration

Group Naming Convention

Consistent naming enables quick identification of group purpose, scope, and membership type.

Format: [Prefix]-[Scope]-[MembershipType]-[Purpose]

All Autopilot Devices Group

Rule Syntax:

(device.devicePhysicalIDs -any (_ -startsWith "[ZTDid]"))

This rule matches any device with a Zero Touch Deployment ID (ZTDid), assigned when a device is registered with Autopilot.

Devices by Group Tag

For department or deployment type differentiation, use exact match syntax:

(device.devicePhysicalIds -any (_ -eq "[OrderID]:YourGroupTagHere"))

The Group Tag field in Intune maps to the OrderID attribute in Entra ID.

Excluding Specific Group Tags

(device.devicePhysicalIDs -any (_ -startsWith "[ZTDId]")) -and -not (device.devicePhysicalIds -any (_ -eq "[OrderID]:Kiosk"))

Dynamic Group Rule Syntax Reference

PowerShell Group Creation

Connect-MgGraph -Scopes "Group.ReadWrite.All"

New-MgGroup -DisplayName "Intune-DEV-DD-Autopilot-All" `
    -MailEnabled:$false -MailNickname "autopilot-all" `
    -SecurityEnabled:$true -GroupTypes "DynamicMembership" `
    -MembershipRule '(device.devicePhysicalIDs -any (_ -startsWith "[ZTDid]"))' `
    -MembershipRuleProcessingState "On"

Dynamic group membership is not instant. Initial processing takes 5-15 minutes typically, up to 24 hours in large tenants. Do not proceed with Autopilot deployment until the device appears in the target group.

Autopilot Device Registration

Manual Hardware Hash Collection at OOBE

At the OOBE screen before deployment, press Shift + F10 to open Command Prompt, run powershell.exe, then execute:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned -Force
Install-Script -Name Get-WindowsAutopilotInfo -Force

# Upload directly to Intune
Get-WindowsAutopilotInfo -Online

# Or save to file
Get-WindowsAutopilotInfo -OutputFile C:\HWID\AutopilotHWID.csv

CSV Import via Intune Portal

Path: Devices > Windows > Windows enrollment > Devices > Import

CSV requirements: plain text (Notepad, not Excel), ANSI encoding, maximum 500 devices per file.

Header format:

Device Serial Number,Windows Product ID,Hardware Hash,Group Tag,Assigned User

Setting Group Tags During Registration

Get-WindowsAutopilotInfo -Online -GroupTag "Production"

Post-registration: Devices > Windows > Windows enrollment > Devices > [Select device] > Edit > Group tag

Autopilot Deployment Profile Configuration

Path: Devices > Windows > Windows enrollment > Deployment Profiles > Create profile > Windows PC

OOBE Settings (Lab Verified)

Device Naming Templates

If using a template (max 15 characters):

Custom naming schemes (e.g., ORION-I, ORION-II with Roman numerals) require manual renaming post-deployment as Autopilot does not support sequential or Roman numeral macros.

Assign the profile to: Intune-DEV-DD-Autopilot-All

Enrollment Status Page Configuration

Path: Devices > Windows > Windows enrollment > Enrollment Status Page > Create

Settings (Lab Verified)

Limit blocking apps to 10 or fewer critical applications. Avoid mixing LOB (MSI) and Win32 apps in ESP blocking list.

Assign to: Intune-DEV-DD-Autopilot-All

White Glove Pre-Provisioning

White Glove (Windows Autopilot for pre-provisioned deployment) enables IT technicians to pre-configure devices before delivery to end users.

Prerequisites

Technician Flow Procedure

1. Connect device to wired Ethernet (recommended)
2. Power on device
3. At first OOBE screen, press Windows key five times
4. Windows Autopilot Configuration screen appears
5. Verify organisation name, assigned user, profile name
6. Select Provision (Windows 10) or Next (Windows 11)
7. Device may reboot, then ESP appears
8. Wait for green success screen
9. Select Reseal - device shuts down
10. Package and ship to end user

Do not proceed past the green screen or sign in. Reseal performs sysprep /shutdown /oobe.

User Flow Procedure

1. User powers on device
2. Connects to network
3. Signs in with Entra ID credentials
4. User ESP (Account setup) runs
5. Desktop becomes available

Local Administrator Account Configuration

The built-in Windows Administrator account is disabled by default and named “Administrator”. Before LAPS can manage a custom-named account, you must enable and rename it via Settings Catalog.

This is required for Windows 10 and Windows 11 versions prior to 24H2. Windows 11 24H2+ can use LAPS Automatic Account Management instead.

Creating the Settings Catalog Policy

Path: Devices > Configuration > Create > New Policy

Click Add settings and search for each setting under Local Policies Security Options:

Account Name Requirements: maximum 20 characters, cannot contain " / \ [ ] : ; | = , + * ? < >

Assignment

Assign to both groups to ensure all devices receive the configuration:

• Intune-All-Windows-Devices (existing enrolled devices)
• Intune-DEV-DD-Autopilot-All (future Autopilot deployments)

Policy Timing Consideration

If LAPS attempts to manage the account before this policy applies, LAPS will fail with Event ID 10013 (account not found). LAPS retries hourly, so once the Settings Catalog policy applies, LAPS will succeed on its next processing cycle.

Windows LAPS Configuration

Creating the LAPS Policy

Path: Endpoint security > Account protection > Create Policy

Configuration Settings (Lab Verified)

Password Complexity Options

Setting 8 produces passwords like HarborPencilMountainDragonRiverForest - easier to read and type than random character strings.

If passphrase settings (6-8) are deployed to older Windows versions, they fall back to complexity setting 4.

Post Authentication Reset Delay

8 hours covers a working day of troubleshooting without leaving passwords exposed indefinitely.

Assignment

Assign to both groups:

• Intune-All-Windows-Devices
• Intune-DEV-DD-Autopilot-All

When adding groups in Endpoint Security policies, you may need to type the group name manually rather than using the picker due to an Intune UI quirk.

BitLocker Configuration and Key Escrow

BitLocker encryption with key escrow to Entra ID ensures recovery keys are centrally stored and accessible for support scenarios.

Creating BitLocker Policy via Endpoint Security

Path: Endpoint security > Disk encryption > Create Policy

Configuration Settings

BitLocker Base Settings

Encryption Methods

Operating System Drive Settings

Fixed Data Drive Settings

Assignment

Assign to both groups for comprehensive coverage:

• Intune-All-Windows-Devices
• Intune-DEV-DD-Autopilot-All

Verifying BitLocker Key Escrow

In Entra ID: Microsoft Entra admin center > Devices > All devices > [Device] > BitLocker keys

In Intune: Devices > All devices > [Device] > Recovery keys

On Device (PowerShell):

# Check BitLocker status
Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, EncryptionPercentage, KeyProtector

# Verify key protector includes recovery password
(Get-BitLockerVolume -MountPoint C:).KeyProtector

Retrieving Recovery Keys

Recovery keys can be retrieved by administrators with Cloud Device Administrator, Intune Administrator, or Helpdesk Administrator roles.

Via Intune: Devices > All devices > [Device] > Recovery keys > Show recovery key

Via Entra ID: Devices > All devices > [Device] > BitLocker keys

LAPS Policy Overlap and Conflict Resolution

When multiple LAPS configurations or policy changes occur, conflicts can arise that prevent proper password management.

Scenario 1: Multiple LAPS Policies Targeting Same Device

Symptoms: Event ID 10017 in LAPS event log, password not rotating, inconsistent password values.

Resolution:

1. Review all LAPS policies in Endpoint security > Account protection
2. Check group assignments for overlap
3. Ensure each device is targeted by only ONE LAPS policy
4. Use Intune filters or exclusion groups to prevent overlap

Scenario 2: Account Name Mismatch

Symptoms: Event ID 10013 (account not found), LAPS policy shows success but no password in portal.

Resolution:

1. Verify Settings Catalog rename value matches LAPS policy exactly
2. Confirm the rename policy has applied by checking local user accounts:

Get-LocalUser | Select-Object Name, Enabled, SID

Scenario 3: Settings Catalog and LAPS Policy Race Condition

Symptoms: Fresh Autopilot deployment, LAPS fails initially then succeeds on retry, Event ID 10013 followed by 10029 after policy sync.

Explanation: LAPS processes before Settings Catalog completes. LAPS looks for the custom account, but it doesn’t exist yet.

Resolution: This is expected behaviour. LAPS retries hourly. Once Settings Catalog applies, next LAPS cycle succeeds. No action required unless failures persist beyond 2-3 hours.

Scenario 4: The Reporting Lag Scenario (Lab Verified)

Symptoms: Local admin renamed successfully on device, Intune portal shows old account name and/or stale password, device event log shows Event ID 10016: “The managed account password does not need to be updated at this time.”

Explanation: LAPS determined the current password is still valid based on the rotation timer. Because no new password was generated, no new report was uploaded to Intune. The portal displays cached/stale data.

Resolution: Force an immediate password rotation to trigger a fresh upload:

# Run on the affected device as Administrator

# Force password rotation (bypasses timer)
Reset-LapsPassword

# Verify success in event log
Get-WinEvent -LogName "Microsoft-Windows-LAPS/Operational" -MaxEvents 5

Look for Event ID 10029 (“Password backed up to Azure AD”) confirming successful upload.

Wait 5 minutes, then refresh Intune portal. Account name and password will update.

Invoke-LapsPolicyProcessing is insufficient here because it respects the rotation timer and will not force a new password if the current one is still valid.

Scenario 5: Legacy LAPS Conflict

Symptoms: Windows LAPS and Legacy Microsoft LAPS both configured, unpredictable password rotation, multiple AdmPwd attributes on computer object.

Resolution:

1. Remove Legacy LAPS GPO settings
2. Uninstall Legacy LAPS agent if present
3. Configure Windows LAPS exclusively

Diagnostic Commands

# Check current LAPS policy on device
Get-LapsPolicy

# Full LAPS diagnostics
Get-LapsDiagnostics

# Review recent LAPS events
Get-WinEvent -LogName "Microsoft-Windows-LAPS/Operational" -MaxEvents 20 | 
    Select-Object TimeCreated, Id, Message | Format-Table -Wrap

# Force policy processing (respects timer)
Invoke-LapsPolicyProcessing

# Force password rotation (ignores timer)
Reset-LapsPassword

LAPS Event ID Reference

Verification and Testing

Pre-Deployment Checklist

Post-Deployment Verification

LAPS Verification

In Intune: Devices > All devices > [Device] > Local admin password

On Device:

# Verify account exists and is enabled
Get-LocalUser -Name "Orion"

# Check LAPS policy applied
Get-LapsPolicy

# View recent LAPS events
Get-WinEvent -LogName "Microsoft-Windows-LAPS/Operational" -MaxEvents 5

BitLocker Verification

In Intune: Devices > All devices > [Device] > Recovery keys

On Device:

Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, EncryptionPercentage

Quick Reference Commands

Device Registration

Install-Script -Name Get-WindowsAutopilotInfo -Force
Get-WindowsAutopilotInfo -Online -GroupTag "Production"

LAPS Management

# View policy
Get-LapsPolicy

# Full diagnostics
Get-LapsDiagnostics

# Force rotation (bypasses timer)
Reset-LapsPassword

# Process policy (respects timer)
Invoke-LapsPolicyProcessing

# View events
Get-WinEvent -LogName "Microsoft-Windows-LAPS/Operational" -MaxEvents 10

BitLocker Management

# Check status
Get-BitLockerVolume

# View key protectors
(Get-BitLockerVolume -MountPoint C:).KeyProtector

# Backup key to Azure AD manually
BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $KeyProtectorId

Graph API Password Retrieval

Connect-MgGraph -Scopes "Device.Read.All","DeviceLocalCredential.Read.All"
Get-LapsAADPassword -DeviceIds "DEVICENAME" -IncludePasswords -AsPlainText

Dynamic Group Creation

Connect-MgGraph -Scopes "Group.ReadWrite.All"

New-MgGroup -DisplayName "Intune-DEV-DD-Autopilot-All" `
    -MailEnabled:$false -MailNickname "autopilot-all" `
    -SecurityEnabled:$true -GroupTypes "DynamicMembership" `
    -MembershipRule '(device.devicePhysicalIDs -any (_ -startsWith "[ZTDid]"))' `
    -MembershipRuleProcessingState "On"

Sources and References

• Windows Autopilot Licensing Requirements
• Autopilot Device Registration
• Pre-provisioned Deployment
• Dynamic Group Rules
• Device Groups for Autopilot
• Windows LAPS Overview
• LAPS Policy Settings
• LAPS Account Management
• LAPS Passwords and Passphrases
• LAPS Troubleshooting
• BitLocker with Intune
• MDM Enrollment
• Entra Device Settings
• Group Naming Convention