LAPSlock

LAPS & BitLocker on your phone

Only for iPhone

Free · In‑App Purchases

iPhone

Retrieve Windows LAPS passwords and BitLocker recovery keys from Entra ID and Intune. Your sign-in, your tenant's audit log, no vendor server in the path. LAPSlock retrieves Windows LAPS local administrator passwords and BitLocker recovery keys from Microsoft Entra ID and Intune — at the helpdesk bench, in the server room, and everywhere the admin center is not. BUILT FOR PEOPLE WHO ARE PAID TO BE SUSPICIOUS • Your sign-in, not ours. LAPSlock uses Microsoft delegated authentication. It can only read what your account can already read, and every retrieval lands in your own tenant's audit log exactly as it would from the admin center. • No vendor server in the credential path. Passwords travel from Microsoft Graph to your device over TLS. Kainor never sees them and has no way to. • Nothing collected. No analytics, no telemetry, no crash reporting, no account to create. The app talks to Microsoft and, only if your organization activates a license, to one license endpoint that receives your tenant ID and nothing else. • Verifiable, not just promised. The source is published for security review, and a ten-minute proxy check confirms every claim above. We would rather you looked than trusted. WHAT IT DOES • Search your fleet by device name, serial, model, or the person using it — matching real names and email addresses, because a ticket names a person more often than a machine. • Reveal a Windows LAPS password behind Face ID or Touch ID, with the managed account name and the backup date. • See previous LAPS passwords where your tenant kept them. A device that stopped checking in is still using an older one, and that is usually the machine you are standing at. • Reveal BitLocker recovery keys per volume, each labelled with the key identifier the locked machine is asking for, so you pick the right one instead of guessing. • Activate a PIM-eligible role without leaving the bench. LAPSlock reads your organization's own policy first, offers only the durations it permits, and tells you up front if a ticket number or extra verification is required. • Switch between customer organizations, for managed service providers. Which organization you are working in is on screen at all times. • Pin the devices you keep coming back to, and see the last few you opened. • Lock the whole app behind Face ID, separately from the check before each reveal. WHAT IT DELIBERATELY DOES NOT DO • Store credentials. A revealed value lives in memory and is destroyed when hidden, on timeout, when the app leaves the foreground, or if a screenshot is detected. • Show credentials in the app switcher. • Ask for write access unless you turn it on. BitLocker key rotation and role activation are opt-in switches; leave them off and LAPSlock only ever requests read permissions. • Read Windows LAPS backed up to Active Directory. LAPSlock reads Entra-backed LAPS. Entra-joined and hybrid-joined devices both work when the policy backs up to Entra ID — a policy targeting Windows Server AD is not readable via Graph. • Retrieve macOS local admin passwords. Microsoft does not expose them through any working API; LAPSlock shows the metadata and links you to the portal rather than pretending. FREE AND PAID Free includes unlimited search and browsing, all metadata, password history, BitLocker keys, copying, role activation, app lock, and five credential reveals per rolling 30 days — enough to prove it works against your own tenant and see the reads in your audit log. A subscription removes the reveal limit. The MSP plan adds switching between customer organizations. Organizations can license by tenant directly from Kainor. Requires an Entra ID account with a role permitted to read Windows LAPS passwords or BitLocker keys, and devices in Intune or Entra ID. LAPSlock is an independent product of Kainor LLC and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation. Microsoft, Microsoft Entra, Microsoft Intune, Windows, and BitLocker are trademarks of Microsoft Corporation. Terms of Use: https://www.apple.com/legal/internet-services/itunes/dev/stdeula/

Ratings & Reviews

  • This app hasn’t received enough ratings or reviews to display an overview.

The developer, Kainor LLC, indicated that the app’s privacy practices may include handling of data as described below. For more information, see the developer’s privacy policy .

  • Data Not Collected

    The developer does not collect any data from this app.

    Privacy practices may vary, for example, based on the features you use or your age. Learn More

    Accessibility

    The developer has not yet indicated which accessibility features this app supports. Learn More

    Information

    Seller
    • Kainor LLC
    Size
    • 6.4 MB
    Category
    • Business
    Compatibility
    Requires iOS 17.0 or later.
    • iPhone
      Requires iOS 17.0 or later.
    Languages
    • English
    Age Rating
    4+
    In-App Purchases
    Yes
    • LAPSlock MSP $49.99
    • LAPSlock Pro $1.99
    • LAPSlock Pro $19.99
    • Learn More
    Copyright
    • © 2026 Kainor LLC
  • Developer Website
  • Privacy Policy