[Poss Bug] - Win - OIB - ES - Windows LAPS - D - LAPS Configuration (24H2+) - v3.6

[O365-Zende]

Baseline Info (please complete the following information):

• OS: Windows 11 Pro Autopiloted Machines
• Win Version: 10.0.26200.7781
• Entra ID Users
• Cloud Only Estate
• M365 BP + Intune

Describe the bug
Win - OIB - ES - Windows LAPS - D - LAPS Configuration (24H2+) - v3.6
Once the policy is active, if I check in Intune at the local admin password section and click "show password," it shows the name WLapsAdmin clearly at the top of the popup window.

or with net user in cmd on the machine, the name appears fine.
but...
Because we are a cloud-only estate, it requires
.\WLapsAdmin not WLapsAdmin

I have tried ASCII, ".\WLapsAdmin" and a number of other tries to set the name correctly in an elevation prompt. But I cannot set .\WLapsAdmin as the Username

If I log in as a local user account, then it works fine with just WLapsAdmin + the pass from Intune and logs straight in correctly as an admin user.

If I try either elevation prompt from double-clicking or right-clicking and run as Admin because the prompt for the Admin name is already set to WLapsAdmin I cant edit it to add the .\

I was hoping prefix was going to do it, but it doesn't accept the chars ..

But now it's setting the name from the policy; I can't get access to the username box.

Expected behaviour
Is there a method to either:
I was hoping to save the user from adding the name, but worst case, always leave the box empty so the user has to type .\ + the name.
Or
Autofill the name but somehow include the .\ but the system doesn't seem to understand it?

Or
Or any other suggestion that might help solve this?

I'm a self-taught admin, so apologies if it's not explained very well.

Additional context
Add any other context about the problem here.

[incedIT]

What is the issue you are having/what are you unable to do? My tenants are cloud-only and LAPS works fine where "WLapsAdmin" is prepopulated.

"." would be used at the Windows login screen to sign in as a local user rather than AAD user, but when using LAPS you can just enter the current LAPS password to elevate anything.

[O365-Zende]

"." would be used at the Windows login screen to sign in as a local user rather than AAD user, but when using LAPS you can just enter the current LAPS password to elevate anything.

That's what I am getting at I think

If I log out of my account and log in to LAPS, it works correctly. (WLapsAdmin + Intne password)

If I double-click a program to install, for example, it fails because it doesn't populate the .\ in front of the username.
Is that the AAD?

I've tried using it with the preset account visible, like this image, and it fails with a bad username or password.

And after the first fail it strangely adds the domain to the end of the username

So if I understand you correctly, it only works correctly from Windows login?
I guess I'll have to adjust my documentation to suit then. That's a shame; I was hoping to get it filled automatically on the popup to elevate.

EDIT:
So, to double-check, any software would be installed as the admin account from the Windows login but still be available for the user to use?

EDIT 2:
Just thought of a flaw: my users (high-end IT, kind of, servers, etc.) may need to elevate a PS window or terminal, etc for BaU. that's not going to work with having to log out and log in as admin. They need to do it as needed.

Is there no way to keep the box for the username clear and not have it autofilled so we can type it manually and just elevate the item/program we need?
We need to elevate from within our user account for some things PS, CMD etc

Many thanks for the reply

[incedIT]

I think something is wrong with your setup, the way it works for me is I am signed into the computer as a standard user, I run a program as admin, UAC appears with "WLapsAdmin" as the username and I just enter the current LAPS password - the program then runs as expected.

If enter an incorrect password, it says incorrect but does not add my domain to the end of the username.

If you go here, is "Enable Microsoft Entra Local Administrator Password Solution (LAPS)" set to "Yes"? That setting catches people out as it's located in a dumb place.

[O365-Zende]

If you go here, is "Enable Microsoft Entra Local Administrator Password Solution (LAPS)" set to "Yes"? That setting catches people out as it's located in a dumb place.

Yes, that's enabled.

Ok, I went and did some digging. I found an old Intune script to set the account name, which I have disabled now.
I was testing before with a script making the admin username, etc.

I redownloaded the OIB policy fresh and started again. No changes as is.
I've verified the account name (WLapsAdmin) exists in the local admin password section pop-out and on the elevation prompt window.
All the machines are autopiloted / EntraID and 25H2.
I've checked all the settings I can find for LAPS in M365 BP, and they are correct.
I have no baseline policies only OIB now

Except now it's worse, as I cant elevate even from a local account login or the popup
It fails with the incorrect username or password across 3 test machines.

Ive checked everything I can think of to make sure there is no overlap and it's 1 setting in Entra and 1 policy in Intune

Not sure how to resolve this. It has partially worked in the past.. but I get its not your issue, ill have to keep looking thx again

[Michael-eit]

@O365-Zende what was the issue? did you get it resolved. Any issues and workarounds help everyone :)

[O365-Zende]

@O365-Zende what was the issue? did you get it resolved. Any issues and workarounds help everyone :)

Still the same, I'm currently working on a Microsoft ticket to see if they can shed more detail.

Ill post back when its finally over..