Deploy Windows LAPS for Local Administrator Passwords

Why this lab matters

Pass the hash and similar lateral movement techniques depend on the same local administrator credential working on many machines. Unique passwords per device break that chain. Windows LAPS (Local Administrator Password Solution) is Microsoft's built-in answer, and it replaces the older separately installed product often called legacy LAPS.

What you need

• A lab domain with a domain controller and at least one domain-joined client. Use Windows 11, or Windows 10, Server 2019 or Server 2022 with the April 2023 update or later.
• Schema Admin rights for Step 1 and Domain Admin rights for the rest.
• An OU for the test client, for example OU=LAPS-Lab,DC=corp,DC=example.

Step 1: Extend the schema

On the domain controller, in an elevated PowerShell session:

Import-Module LAPS
Update-LapsADSchema -Verbose

This adds attributes such as msLAPS-Password, msLAPS-EncryptedPassword and msLAPS-PasswordExpirationTime to computer objects. A schema change cannot be undone, which is one more reason to practise in a lab.

Step 2: Set permissions

1. Let computers in the OU update their own password:

   Set-LapsADComputerSelfPermission -Identity "OU=LAPS-Lab,DC=corp,DC=example"

2. See who can already read confidential attributes in the OU. Anyone unexpected here needs fixing before you go further:

   Find-LapsADExtendedRights -Identity "OU=LAPS-Lab,DC=corp,DC=example"

3. Create a reader group and grant it read and reset rights:

   New-ADGroup -Name "GRP-LAPS-Readers" -GroupScope Global -GroupCategory Security
   Set-LapsADReadPasswordPermission  -Identity "OU=LAPS-Lab,DC=corp,DC=example" -AllowedPrincipals "CORP\GRP-LAPS-Readers"
   Set-LapsADResetPasswordPermission -Identity "OU=LAPS-Lab,DC=corp,DC=example" -AllowedPrincipals "CORP\GRP-LAPS-Readers"

Step 3: Configure Group Policy

1. If the LAPS settings are missing from the editor, copy LAPS.admx and its language file from C:\Windows\PolicyDefinitions on an updated machine into your central store.
2. Create a GPO named LAPS-Lab-Policy and link it to the OU.
3. Edit it and open Computer Configuration, Policies, Administrative Templates, System, LAPS.

Setting	Lab value
Configure password backup directory	Enabled, Active Directory
Password Settings	Enabled. Large letters, small letters, numbers and specials. Length 20. Age 30 days
Enable password encryption	Enabled, if your functional level supports it
Configure authorized password decryptors	CORP\GRP-LAPS-Readers
Post-authentication actions	Enabled. Grace period 8 hours. Reset the password and log off the managed account
Name of administrator account to manage	Leave unset to manage the built-in Administrator, or name your custom account

Step 4: Apply and check the client

gpupdate /force
Invoke-LapsPolicyProcessing

Open Event Viewer on the client and go to Applications and Services Logs, Microsoft, Windows, LAPS, Operational. Event ID 10018 confirms the password was updated in Active Directory. Event ID 10004 marks a processing cycle that finished successfully.

Step 5: Retrieve the password

Get-LapsADPassword -Identity "PC01" -AsPlainText

The output shows the account name, the password and the expiry time. You can also open the computer object in Active Directory Users and Computers and use the LAPS tab. Now sign in as a normal domain user who is not in the reader group and run the same command. The password field should come back empty.

Step 6: Use it, then rotate it

1. Sign in to the client with the local account and the retrieved password.
2. Force a rotation from the directory side, which takes effect at the next policy cycle:

   Set-LapsADPasswordExpirationTime -Identity "PC01"

   or rotate at once on the device itself:

   Reset-LapsPassword

3. Retrieve the password again and confirm it has changed.

Evidence to keep

• The output of Find-LapsADExtendedRights after clean up.
• A GPO settings report for the policy.
• Two retrievals showing different passwords and expiry times.