Event ID 10005LAPS policy processing failed

What to check

Use the error code and the events logged between 10003 and 10005 to find the failing step.

Find it with PowerShell

Run on the machine that logs it.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-LAPS/Operational'; Id = 10005 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-LAPS/Operational log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-LAPS/Operational" and EventID == 10005
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related LAPS events

• Event ID 10003: LAPS policy processing started
• Event ID 10004: LAPS policy processing succeeded
• Event ID 10018: Password backed up to Active Directory
• Event ID 10029: Password backed up to Microsoft Entra ID
• Event ID 10020: Local account password updated
• Event ID 10021: Policy configuration: Active Directory backup
• Event ID 10022: Policy configuration: Microsoft Entra ID backup
• Event ID 10023: Policy configuration: legacy Microsoft LAPS

Search all 123 event IDs →