Event ID 10003LAPS policy processing started

What to check

Read the events that follow up to the matching 10004 or 10005.

Find it with PowerShell

Run on the machine that logs it.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-LAPS/Operational'; Id = 10003 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-LAPS/Operational log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-LAPS/Operational" and EventID == 10003
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related LAPS events

• Event ID 10004: LAPS policy processing succeeded
• Event ID 10005: LAPS policy processing failed
• Event ID 10018: Password backed up to Active Directory
• Event ID 10029: Password backed up to Microsoft Entra ID
• Event ID 10020: Local account password updated
• Event ID 10021: Policy configuration: Active Directory backup
• Event ID 10022: Policy configuration: Microsoft Entra ID backup
• Event ID 10023: Policy configuration: legacy Microsoft LAPS

Search all 123 event IDs →