← cd ~/events
// events/10021 · LAPS
Event ID 10021Policy configuration: Active Directory backup
Lists the current LAPS policy when backup is to Windows Server AD (source, account, age, complexity, length, encryption and so on).
| Log | Microsoft-Windows-LAPS/Operational |
|---|---|
| Source | Microsoft-Windows-LAPS |
| Area | LAPS |
What to check
Use it to confirm which settings the device actually received.
Find it with PowerShell
Run on the machine that logs it.
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-LAPS/Operational'; Id = 10021 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
This works once a data collection rule sends the Microsoft-Windows-LAPS/Operational log to your workspace, where it lands in the Event table.
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-LAPS/Operational" and EventID == 10021
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated descRelated LAPS events
- Event ID 10003: LAPS policy processing started
- Event ID 10004: LAPS policy processing succeeded
- Event ID 10005: LAPS policy processing failed
- Event ID 10018: Password backed up to Active Directory
- Event ID 10029: Password backed up to Microsoft Entra ID
- Event ID 10020: Local account password updated
- Event ID 10022: Policy configuration: Microsoft Entra ID backup
- Event ID 10023: Policy configuration: legacy Microsoft LAPS