Event ID 10029Password backed up to Microsoft Entra ID

What to check

None needed. If it is missing, work back through the cycle from 10003 and check for a 10005 failure.

Find it with PowerShell

Run on the machine that logs it.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-LAPS/Operational'; Id = 10029 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-LAPS/Operational log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-LAPS/Operational" and EventID == 10029
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related LAPS events

• Event ID 10003: LAPS policy processing started
• Event ID 10004: LAPS policy processing succeeded
• Event ID 10005: LAPS policy processing failed
• Event ID 10018: Password backed up to Active Directory
• Event ID 10020: Local account password updated
• Event ID 10021: Policy configuration: Active Directory backup
• Event ID 10022: Policy configuration: Microsoft Entra ID backup
• Event ID 10023: Policy configuration: legacy Microsoft LAPS

Search all 123 event IDs →