The local administrator account is disabled when on-premises LAPS is decommissioned and the device is moved to Intune as co-managed, without a corresponding Windows LAPS policy being applied for the same local account

You can manage local administrator passwords using either on-premises LAPS or Windows LAPS via Intune, but not both simultaneously. It's important to properly offboard from the legacy LAPS setup before transitioning to cloud-based Windows LAPS.

🔹 Do devices need to be fully managed by Intune to use Windows LAPS?

No, they don’t. In a co-managed environment, you can selectively assign workloads between Configuration Manager and Intune. To manage Windows LAPS via Intune, you only need to shift the Configuration Policies workload to Intune. There's no requirement to move all workloads. Once this is done, Intune can successfully manage local admin password rotation and storage—even for co-managed devices.

🔹 How long does on-prem AD retain local admin passwords after decommissioning legacy LAPS?

Once the legacy LAPS infrastructure (GPO, LAPS client, and AD schema) is decommissioned:

• The stored passwords in Active Directory remain until:
  • They are manually cleared.
    • The computer object is deleted.
      • A new password rotation occurs via another system (e.g., Windows LAPS).

Without the LAPS client or GPO, no further password rotations will occur, and the stored password will become stale over time.

🕒 There is no automatic expiration of these passwords unless a custom cleanup mechanism is implemented.