What are the best methods for rotating local admin passwords on a large fleet of Windows laptops?

LAPS is truly user-friendly when integrated with Intune. I managed to create a dynamic list in Entra and got it running in no time. I highly recommend it for any fleet of this size.

Consider using Windows LAPS (Local Administrator Password Solution). It's designed exactly for tasks like yours and can work both on-premises and through Intune. Setting it up is pretty straightforward and would automate the process for you.

If you're looking for alternatives, I came across a script from the SANS SEC505 course that rotates passwords and encrypts them, saving the details to a file share. It has some nice flexibility, such as scheduling and working on multiple accounts.

LAPS is definitely the way to go. It's a reliable tool that not only handles password rotation but is also integrated well with Active Directory. Plus, it's free since it's a Microsoft solution. No additional licensing needed, which is a huge plus!

I do want to mention that while LAPS is a solid solution, some folks find it adds unnecessary complexity. If you want something simpler, consider tools like Admin By Request—it can help control admin access and includes features for password management but at a cost.