Choosing between the Microsoft and Lithnet agents for LAPS support

Managing local admin passwords safely and securely relies on having a mechanism to generate and store the local admin passwords. There are three supported agents you can use with Access Manager to manage your device local admin passwords. This guide will help you choose the right option for your environment.

Option 1: Legacy LAPS client

Microsoft's tried and true legacy LAPS client provides support for managing LAPS passwords for Active Directory joined devices. It supports a wide range of legacy and modern Windows operating systems.


  • Has the broadest support for OS coverage

  • Easy to deploy and configure via group policy


  • Windows only

  • Supports Active Directory domain-joined machines only

  • Passwords are stored in the directory in plain-text

  • Does not store a history of previously used local admin passwords

  • Deprecated and no longer being updated by Microsoft

When should I use legacy LAPS?

  • You have an existing deployment of legacy LAPS

  • You need to support legacy Windows operating system versions

Option 2: Windows LAPS client

In April 2023, Microsoft released LAPS as a built-in Windows feature. This also brought a range of new support for things like password history, encryption, and support for Azure AD joined devices.


  • Support for both AD and Azure AD joined devices

  • Has password history support

  • Optionally encrypts passwords stored in Active Directory

  • Built into Windows

  • Actively supported and developed by Microsoft


  • Windows only

  • No support for older operating systems that are still in support. Only supported on Windows 11, Windows Server 2019 and higher, and Windows 10 versions supported as of April 2023.

When should I use Windows LAPS?

  • Your organization has modern Windows operating systems either joined to Azure AD or Active Directory

Option 3: Lithnet Access Manager agent

Lithnet Access Manager has its own agent that can be used to manage the local admin passwords of your devices. It has full support for encrypted passwords, password history, and is not just supported on Windows, but macOS and Linux as well.


  • Supports Windows, macOS, and Linux

  • Encrypts all passwords

  • Has password history support

  • Supports Windows Server 2012 R2 and higher, as well as Windows 8.1 and higher

  • Supports domain joined, Azure AD-joined, as well as standalone Windows devices


  • No support for out-of-date operating systems. Only supported on Windows 8.1 and above and Windows Server 2012 R2 and above

When should I use the Lithnet Access Manager agent?

  • You have macOS and Linux devices you want to support

  • You have Windows devices not joined to a domain

  • You want fully encrypted local admin passwords in all scenarios

  • You want one LAPS client solution for your entire Windows and non-Windows fleet

Note, that you are not restricted to the use of a single LAPS client type in your environment.

For example, you can use the legacy LAPS client on legacy operating systems, Windows LAPS on modern operating systems, and Access Manager Agent on macOS and Linux devices.

Access Manager Server can read LAPS passwords from any client listed on this page.

Operating system support

The Microsoft agents works only on Windows AD or Azure AD-joined devices. Lithnet Access Manager agent supports a much wider range of operating systems.

Operating systemMicrosoft Legacy LAPS AgentMicrosoft Windows LAPS AgentLithnet Access Manager Agent

Windows Vista, Windows 7 and Windows 8

Windows 8.1

Windows 10

Windows 11 and higher

Windows Server 2012 R2

Windows Server 2016

Windows Server 2019 and higher



Supported join types

Join typeMicrosoft Legacy LAPS AgentMicrosoft Windows LAPS AgentLithnet Access Manager Agent

Active Directory joined devices

Azure Active Directory joined devices

Azure Active Directory registered devices

Non-domain joined devices (workgroup)

Feature comparison

FeatureMicrosoft Legacy LAPS AgentMicrosoft Windows LAPS AgentLithnet Access Manager Agent

Regularly rotates the local admin password

Requires a custom schema for AD password storage

Stores a history of previous local admin passwords

Stores passwords in plain-text

Encrypts passwords

Write passwords to Active Directory

Write passwords to Azure Active Directory

Write passwords to the AMS server

1. Custom schema is only required if using the agent on domain-joined devices. Schema is not required when using the agent on non-windows or non-domain-joined devices

2. Access Manager agent can store unencrypted passwords in the Microsoft LAPS attributes when in compatibility mode (applies to domain-joined Windows devices only)

3. Windows LAPS can store passwords in plain text if configured

Compatibility with password retrieval solutions

Legacy LAPS thick clientWindows LAPS AD property pagesWindows LAPS PowerShellAzure PortalAccess Manager Service

Microsoft Legacy LAPS passwords stored in AD

Microsoft Windows LAPS passwords stored in AD

Microsoft Windows LAPS passwords stored in Azure AD

Access Manager Agent passwords

Last updated