How to Deploy macOS LAPS (Local Administrator Password Solution) for Enterprise Endpoint Security

In Windows environments, the Local Administrator Password Solution (LAPS) has been a foundational security control for over a decade. It ensures that the built-in local administrator account on every laptop has a unique, highly complex, and regularly rotating password, preventing lateral movement (Pass-the-Hash) attacks.

For macOS, achieving this same level of security was historically a nightmare. IT administrators either used the same static administrator password across the entire fleet (a catastrophic security risk) or relied on fragile, custom bash scripts that attempted to rotate the password and upload it to a hidden cloud database or a Jamf Pro extension attribute.

With the release of macOS 14 Sonoma, Apple introduced native support for macOS LAPS. Built directly into the core operating system, macOS can now autonomously rotate a local administrator password and securely escrow the new credential directly to your Mobile Device Management (MDM) server using the MDM protocol, completely eliminating the need for third-party scripts.

This guide explains how to architect and deploy native macOS LAPS to secure your enterprise Apple fleet.

Understanding the macOS LAPS Architecture

The native Apple LAPS framework relies on three specific MDM commands and payloads:

1. The Configuration Profile: The MDM sends a payload to the Mac instructing it which local account to manage and what the rotation policies should be.
2. The Rotation Trigger: The Mac generates a cryptographically secure, random password, updates the local account (modifying the Secure Enclave / OpenDirectory record), and encrypts the new password.
3. The Escrow Payload: The Mac securely transmits the encrypted password back to the MDM server (via the SetAutoAdminPassword or equivalent MDM protocol channel) where authorized IT staff can retrieve it.

Step 1: Prerequisites for macOS LAPS

Before deploying the configuration, ensure your environment meets the strict baseline requirements:

• Operating System: The target Mac must be running macOS 14 Sonoma (or later).
• MDM Vendor Support: Your MDM vendor (e.g., Jamf Pro 11.x, Microsoft Intune, Kandji, Mosyle) must have explicitly updated their backend API to support the Apple LAPS protocol extensions.
• The Target Account: The local administrator account you intend to manage (e.g., localadmin) must already exist on the Mac.

Step 2: Creating the Managed Administrator Account

macOS LAPS cannot create the account; it can only manage an existing one.

If you are provisioning new Macs using Automated Device Enrollment (Apple Business Manager), you can configure your MDM PreStage Enrollment to automatically create a hidden local administrator account (e.g., itadmin) during the Setup Assistant.

For existing Macs, you must push a script or a package to create this account before enabling LAPS.

Step 3: Configuring the MDM LAPS Payload

The exact UI will differ based on your MDM, but you must configure a specific LAPS Configuration Profile.

In your MDM console, create a new macOS LAPS (or Local Administrator Password) policy.

You must define the following critical parameters:

1. Managed Account Name: Enter the exact shortname of the local account (e.g., itadmin). If this does not perfectly match the existing account on the Mac, the profile will fail to install.
2. Password Complexity: Define the cryptographic requirements. (e.g., 20 characters, requiring uppercase, lowercase, numbers, and symbols). Apple’s native generator will construct the password based on these rules.
3. Rotation Frequency: Set the maximum age of the password (e.g., 30 days). The Mac will autonomously rotate the password when this timer expires.
4. Post-Viewing Rotation: (Highly Recommended). Enable the setting that automatically rotates the password immediately after an IT administrator views it in the MDM console. This ensures the password acts as a single-use “break glass” credential.

Step 4: Deploying and Validating the Escrow

Deploy the Configuration Profile to a pilot group of macOS 14 devices.

When the profile lands on the Mac, the mdmclient daemon executes the password rotation instantly. You will not see a popup on the Mac; the process is entirely silent.

To validate the deployment:

1. Navigate to the device record in your MDM console.
2. Locate the Local Administrator Password or LAPS tab.
3. You should see the newly generated password, along with a timestamp of when it was last rotated and when it is scheduled to expire.
4. Click the “View Password” button (your MDM should log this action in its audit trail for compliance purposes).
5. Attempt to log into the physical Mac (or via SSH) using the itadmin account and the escrowed password.

Step 5: Handling FileVault Considerations

If FileVault (Full Disk Encryption) is enabled on the Mac, you must understand a critical architectural limitation: A LAPS-managed account cannot be used to unlock the disk at the FileVault pre-boot screen.

Because the LAPS password rotates autonomously, and the FileVault pre-boot screen has no internet access to sync with the MDM, the pre-boot screen would not know the newly rotated password. Therefore, Apple explicitly restricts LAPS accounts from having a SecureToken for FileVault decryption.

If you need to unlock a FileVault-encrypted Mac, you must use a standard user account or the Personal Recovery Key (PRK) escrowed in your MDM.

Conclusion

Native macOS LAPS closes one of the most significant security gaps in the Apple enterprise ecosystem. By allowing the operating system to autonomously generate, rotate, and securely escrow local administrator passwords directly via the MDM protocol, security architects can eliminate static credentials, neutralize Pass-the-Hash vulnerabilities, and enforce true Zero Trust endpoint compliance on macOS.