In many companies, computers are installed from a single image and the local Administrator password is identical on all of them. It is a password that has not changed in years and that several former IT staff still know. An attacker who obtains it from one computer can move across the entire network.
What Is Windows LAPS?
LAPS (Local Administrator Password Solution) sets the local administrator password on each computer automatically, randomly and uniquely, rotates it on a set schedule, and stores it in Active Directory or Microsoft Entra ID. Only authorized people can read the password.
- Windows LAPS: the new version, built into Windows 10 and 11 and Windows Server 2019 and later, provided recent updates are installed. It requires no separate software.
- Legacy LAPS: the older tool, installed on computers as a separate package. Windows LAPS replaces it and adds features such as password encryption and password history.
Do not use Legacy LAPS and Windows LAPS at the same time to manage the same account on the same computer. If you have Legacy LAPS, plan the migration and carry it out OU by OU.
Prerequisites
- Target computers and servers run a supported Windows version with recent updates.
- You need Schema Admins rights once to extend the domain schema.
- To encrypt passwords in Active Directory, the domain functional level must be Windows Server 2016 or higher.
Setup in Active Directory
- The LAPS PowerShell module is present on up-to-date systems. Extend the schema with
Update-LapsADSchema. - Allow computers in the target OU to write their own password to AD:
Set-LapsADComputerSelfPermission -Identity "OU=Workstations,DC=example,DC=local" - Grant the support group permission to read passwords:
Set-LapsADReadPasswordPermission -Identity "OU=Workstations,DC=example,DC=local" -AllowedPrincipals "EXAMPLE\IT-Helpdesk" - Create a GPO for the same OU and configure the settings under Computer Configuration > Administrative Templates > System > LAPS.
Key GPO Settings
- Configure password backup directory: set the backup destination to Active Directory. Without this setting, LAPS does not store the password anywhere.
- Password Settings: complexity, length and maximum password age. Choose a long password and a limited lifetime.
- Name of administrator account to manage: if you use a different local admin account instead of the built-in Administrator, enter its name here.
- Enable password encryption: passwords are stored encrypted in AD.
- Post-authentication actions: after the password is used, it is changed after a set period and, if configured, the user’s session is also closed.
On domain controllers, Windows LAPS can also back up the DSRM password, which you will need on the day of a crisis and domain recovery.
Day-to-Day Use and Troubleshooting
- To view a computer’s password:
Get-LapsADPassword -Identity PC-ACC-01 -AsPlainText. A LAPS tab is also added to the computer’s properties in Active Directory Users and Computers. - To rotate the password immediately on the computer itself, run
Reset-LapsPassword. - LAPS events are logged in Event Viewer under Applications and Services Logs > Microsoft > Windows > LAPS. This is the first place to look when troubleshooting.
- After applying the GPO, run
gpupdate /forceand check these events to confirm the password was stored in AD.
Checklist
- The schema is extended and write and read permissions are set on the OU.
- A GPO with Active Directory as the destination and password settings is applied.
- Only a specific group can read passwords.
- Password encryption is enabled.
- Legacy LAPS and Windows LAPS do not manage the same account at the same time.
- Password storage has been verified on a few sample computers.
ITPlus724 engineers can deploy Windows LAPS in your domain, migrate you from Legacy LAPS, and define precisely who can read passwords.