Recover Local Admin access on my laptop

If the local Administrators group is literally empty and no LAPS credential exists, back up accessible data and reset or reinstall Windows, because assigning an Entra administrator role does not recreate the missing device-side group membership.

Recover the laptop

1. Back up all accessible files to external or cloud storage.
2. Obtain the BitLocker recovery key before proceeding. For a work or school device, sign in from another device with the work account, select Devices, expand the laptop, and select View BitLocker Keys. Match the displayed key ID if Windows asks for the key.^1^
3. Open Windows Recovery Environment:
   • From the sign-in screen, hold Shift, select Power > Restart; or
   • If Windows is accessible, open Settings > System > Recovery > Advanced startup > Restart now.
4. Select Troubleshoot > Reset this PC.
5. Choose:
   • Keep my files to preserve personal files while removing applications and settings.
   • Remove everything for a completely fresh installation.
   • Prefer Cloud download if the local Windows image might be damaged.
6. Do not interrupt the reset, even if the screen remains black for an extended period. Reset reinstalls Windows, and the selected option determines whether personal files are retained.^2^
7. During Windows setup, provision the device so that at least one account receives local administrator access. If the laptop must remain Entra joined, verify the intended provisioning policy before completing the join.

If Reset this PC fails, perform a clean installation from Windows recovery media or manufacturer recovery media. Microsoft positions clean installation as the next recovery option when reset is unsuccessful.^3^

Why an Entra role assignment is not the primary fix here

During Microsoft Entra join, Windows adds these principals to the local Administrators group:

• Microsoft Entra Joined Device Local Administrator role
• Global Administrator role
• The user performing the join

That device-side update occurs during the join operation. Later assignments to the Microsoft Entra Joined Device Local Administrator role provide privileges through the role principal already present on the laptop; they do not repair an Administrators group from which that principal was removed.^4^

Consequently, directory roles such as Global Administrator or Intune Administrator are not substitutes for an existing device-local administrator token.

Conditional check: the group may only appear to have no users

If “no members” means no individually named users are displayed, but the Entra role principal remains, an Entra administrator can try the cloud role route:

1. Run this from a non-elevated Command Prompt if permitted:

      net localgroup administrators
   

2. If the output still contains the Microsoft Entra role principal, have a Privileged Role Administrator open: Microsoft Entra admin center > Entra ID > Devices > All devices > Device settings > Manage Additional local administrators on all Microsoft Entra joined devices.
3. Select Add assignments and assign the recovery account.
4. Wait up to four hours, then sign out and sign back in; locking and unlocking is insufficient.

This requires Entra ID P1 or P2 and applies to all Entra-joined devices in the tenant, not only this laptop. Remove a temporary assignment after recovery. It also does not apply to B2B guest users.^4^

Do not attempt net localgroup administrators /add ... before recovery: Microsoft documents that manual elevation requires an account that is already a member of the local Administrators group.^4^

Prevent recurrence

After recovery, configure Windows LAPS to back up a managed local administrator password to Microsoft Entra ID. An unmanaged Entra-joined device can use manually deployed Windows LAPS policy; at minimum, BackupDirectory must be set to 1 for Entra ID backup.^5^

References

1. Find your BitLocker recovery key | Microsoft Support
2. Windows 11
3. Windows device recovery framework
4. How to manage the local administrators group on Microsoft Entra joined devices
5. Get started with Windows LAPS and Microsoft Entra ID