Windows LAPS passwords and passphrases
Learn about how passwords and passphrases are created for Windows Local Administrator Password Solution (Windows LAPS).
Overview
The primary purpose of Windows LAPS is regularly rotate the password of a local Windows account. It's important to understand how Windows LAPS generates random passwords (or random passphrases).
Password character sets
Windows LAPS supports five different complexity settings that can be used to generate random passwords. The PasswordComplexity policy setting is used to choose which character sets are used when creating a password.
| PasswordComplexity setting | Description | Character sets |
|---|---|---|
| 1 | Large letters | "ABCDEFGHIJKLMNOPQRSTUVWXYZ" |
| 2 | Large letters + small letters | "ABCDEFGHIJKLMNOPQRSTUVWXYZ" "abcdefghijklmnopqrstuvwxyz" |
| 3 | Large letters + small letters + numbers | "ABCDEFGHIJKLMNOPQRSTUVWXYZ" "abcdefghijklmnopqrstuvwxyz" "0123456789" |
| 4 | Large letters + small letters + numbers + specials | "ABCDEFGHIJKLMNOPQRSTUVWXYZ" "abcdefghijklmnopqrstuvwxyz" "0123456789" ",.-+;!#&@{}[]$/()%" |
| 5 | Large letters + small letters + numbers (improved readability) | "ABCDEFGHJKLMNPRSTUVWXYZ" "abcdefghijkmnpqrstuvwxyz" "23456789" "!#%+@:=?*" |
When a complexity setting with multiple character sets is chosen, Windows LAPS ensures that the resultant password contains at least one character randomly chosen from each character set.
The length of passwords is controlled using the PasswordLength policy setting. Passwords created by Windows LAPS default to 14 characters in length, and can be configured to be anywhere from 8-64 characters in length.
Password complexity setting five is equivalent to password complexity setting four, with the following modifications made to improve readability and avoid confusion. The differences between setting four and setting five are as follows:
- Removes the letters 'I', 'O', 'Q', 'l', and 'o'
- Removes the numbers '0' and '1'
- Removes the symbols ',', '.', '&', '{', '}', '[', ']', '(', ')', and ';'
- Adds the symbols ':', '=', '?', and '*'
Important
The PasswordComplexity setting of '5' is only supported in Windows 11 24H2, Windows Server 2025 and later releases. It is not required to deploy any Windows Server 2025 domain controllers in order to use this new setting.
Passphrase word lists
Windows LAPS supports three different complexity settings that can be used to generate random passphrases. The PasswordComplexity policy setting is used to choose which word lists are used when creating a passphrase:
| PasswordComplexity setting | Description | Number of words in list |
|---|---|---|
| 6 | Long words | 7776 |
| 7 | Short words | 1276 |
| 8 | Short words with unique prefixes | 1276 |
The length of passphrases is controlled using the PassphraseLength policy setting. Passphrases created by Windows LAPS default to six words in length, and can be configured to be anywhere from three to 10 terms in length. The first character of each word is always capitalized for improved readability. No punctuation or other dividing characters are used between words.
Example of a passphrase created with six words taken from the "Long words" list:
SkiingProduceIdentifyStarlitOctaneDistress
Passphrase word lists were taken from "Deep Dive: EFF's New Wordlists for Random Passphrases" by Electronic Frontier Foundation, and are used under a CC-BY-3.0 Attribution license. The specific contents of all Windows LAPS passphrase word lists can be downloaded from Windows LAPS Passphrase Word Lists. Microsoft made slight modifications to the original word lists; all changes are detailed in the downloadable lists.
Important
Windows LAPS passphrase support is only supported in Windows 11 24H2, Windows Server 2025 and later releases. It is not required to deploy Windows Server 2025 domain controllers in order to use this new setting.
Entropy considerations
Windows LAPS creates truly random passwords and passphrases (no human bias is possible). It's therefore simple to calculate the resultant bits of entropy for a password\passphrase of a given length. The following table lists the resulting bits of entropy across a sample set of password\passphrase lengths.
The supported password complexity settings are listed across the top of the table, and password\passphrase lengths are listed down the left hand side. The entropy values for the default policy length settings are bolded:
| PasswordComplexity setting -> Password or passphrase length V |
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 |
|---|---|---|---|---|---|---|---|---|
| 3 | 39 | 31 | 31 | |||||
| 4 | 52 | 41 | 41 | |||||
| 5 | 65 | 52 | 52 | |||||
| 6 | 78 | 62 | 62 | |||||
| 7 | 90 | 72 | 72 | |||||
| 8 | 38 | 46 | 48 | 51 | 48 | 103 | 83 | 83 |
| 9 | 42 | 51 | 54 | 57 | 54 | 116 | 93 | 93 |
| 10 | 47 | 57 | 60 | 63 | 60 | 129 | 103 | 103 |
| 11 | 52 | 63 | 65 | 70 | 66 | |||
| 12 | 56 | 68 | 71 | 76 | 72 | |||
| 13 | 61 | 74 | 77 | 82 | 78 | |||
| 14 | 66 | 80 | 83 | 89 | 84 | |||
| 20 | 94 | 114 | 119 | 126 | 120 | |||
| 40 | 188 | 228 | 238 | 253 | 240 | |||
| 60 | 282 | 342 | 357 | 379 | 360 |
At the higher end of the allowable length ranges, the entropy levels could be considered excessive for most normal IT environments. Consider that there's usually a security versus usability tradeoff involved. For example, it's difficult for human beings to read and type long and complex passwords. Switching to passphrases is a useful way to improve these issues while still retaining a reasonable amount of entropy. If maximizing security is a paramount concern you might instead consider alternative protections, for example maintaining the managed account in a disabled state by default.
See also
Next steps
Now that you understand how passwords and passphrases are created, take a look at these other sections.