Windows LAPS event IDs and errors: Entra ID and AD backup, policy and password rotation

Windows LAPS writes every policy cycle, password change and backup attempt to its own event log, using IDs in the 10000 range. This quick reference lists the events Microsoft documents for Microsoft Entra ID and Active Directory backup, policy processing and post-authentication actions, each with the usual cause and the first thing to check.

How to read these events#

Open Event Viewer › Applications and Services Logs › Microsoft › Windows › LAPS › Operational. Windows LAPS processes its policy every hour, and each background cycle is bracketed: it starts with 10003 and ends with 10004 (success) or 10005 (failure). The events in between say what went wrong, so read a failed cycle from its 10003 onward instead of looking at 10005 alone.

• Scenario matters. Some events only occur when the device backs up to Active Directory (AD), some only for Microsoft Entra ID, and some in both. The tables mark the scenario Microsoft assigns.
• Error codes are HRESULTs. A 10005 or 10043 event can carry a code such as 80070032, which is Win32 error 50, "The request is not supported". Decode any code with certutil -error 0x80070032.
• Old names in event text. Windows still prints "Azure" and "Azure Active Directory" in these messages; the target is Microsoft Entra ID, so search for both names.
• Domain controllers are different. On a DC, the LAPS log only records management of the DSRM account, never the client behavior described here.
• Not every ID is documented. Microsoft publishes the most common events; read any other ID in the context of its cycle.

To run a cycle now and read it in order, use an elevated PowerShell window:

Invoke-LapsPolicyProcessing
Get-WinEvent -LogName 'Microsoft-Windows-LAPS/Operational' -MaxEvents 25 |
    Sort-Object TimeCreated |
    Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

When the events aren't enough, Get-LapsDiagnostics collects the logs and traces for a deeper investigation or a support case.

Policy cycle and configuration events#

Managed account and password events#

If the account itself is the problem, see managing local Administrators with Intune.

Microsoft Entra ID backup events#

Active Directory backup events#

For the underlying directory problems, see the AD replication and LDAP bind quick references.

Post-authentication action events#

When post-authentication actions are configured, LAPS watches for sign-ins with the managed account and resets the password after the grace period in policy.

How to verify a fix#

1. Run Invoke-LapsPolicyProcessing and read the new cycle. Healthy looks like 10003, then 10021 or 10022, then 10004, with no 10005.
2. To prove the backup path end to end, force a rotation with Reset-LapsPassword and expect 10018 or 10029 plus 10020 in that cycle. Don't script it in a loop: Microsoft warns that excessive use can be throttled.
3. Confirm the directory has the new password:

# Microsoft Entra ID: metadata only needs Device.Read.All + DeviceLocalCredential.ReadBasic.All
Connect-MgGraph -TenantId '<tenant-id>' -ClientId '<app-client-id>'
Get-LapsAADPassword -DeviceIds 'PC-0042'

# Active Directory
Get-LapsADPassword -Identity 'PC-0042'

Success is an expiration time that moved forward with the rotation you just triggered. In Intune, the device's Local admin password page should show the new rotation time. Watch the log for a few hourly cycles before closing the ticket.

References#

• Windows LAPS troubleshooting guidance
• Use Windows LAPS event logs
• Get started with Windows LAPS and Microsoft Entra ID