LAPS: a unique local administrator password on every machine
The same local administrator password on every workstation built from one image is an open road from the first infected machine to all the others. Windows LAPS fixes this with no extra licences, and a few queries show whether protection covers the whole fleet.
Guide Privileged access Part 2 of 5
- Privileged accounts in Active Directory: a tiering model without a full PAM rollout
- LAPS: a unique local administrator password on every machine
- Signing in to admin tools through Active Directory: LDAPS or OIDC
- Emergency access accounts: getting in when directory sign-in stops working
- Remote access for vendors: a recorded-session gateway instead of VPN for everyone
An incident review shows that within one afternoon the attacker moved from an infected laptop to dozens of other computers. They cracked no passwords. Every workstation had been built from the same image with the same local administrator password, so reading its hash on the first machine was enough to use it on all the others.
Windows LAPS removes this problem: every machine has its own random password, changed automatically and stored encrypted in the directory. Deployment takes an afternoon, and maintenance comes down to a few queries run once a month.
What Windows LAPS is
Windows LAPS (Local Administrator Password Solution) is built into Windows 10, Windows 11 and Windows Server 2019 or later, with updates from April 2023 onwards. On every machine it generates a random password for a designated local account, rotates it on a schedule and stores a copy in Active Directory or Microsoft Entra ID. People granted the right can read the current password of a specific machine when they need it.
The older version, installed separately as an MSI package with a Group Policy extension, is being retired. New deployments should use the built-in version, which adds password encryption in the directory, password history and post-authentication actions.
Deployment in Active Directory
Preparing the directory takes three commands from the LAPS module: the schema extension, the write right for computers and the read right for a chosen group. Permissions are granted separately for each organisational unit that contains computers.
Import-Module LAPS
# Once, from an account that is a member of Schema Admins
Update-LapsADSchema
$ou = 'OU=Workstations,OU=Computers,DC=corp,DC=example,DC=com'
# Computers in this OU can write their own password
Set-LapsADComputerSelfPermission -Identity $ou
# Password reads only for the workstation support group
Set-LapsADReadPasswordPermission -Identity $ou -AllowedPrincipals 'CORP\GG-LAPS-Readers'Read auditing is enabled with Set-LapsADAuditing and its -AuditedPrincipals parameter, which names whose reads are recorded. The events land in the domain controllers’ security log, provided the audit policy enables directory service access auditing.
Machine behaviour is set by a Group Policy object under Computer Configuration › Policies › Administrative Templates › System › LAPS.
| Setting | Value for workstations |
|---|---|
| Configure password backup directory | Active Directory |
| Password Settings | upper and lower case letters, numbers, special characters; length 20; age 30 days |
| Name of administrator account to manage | not configured, meaning the built-in Administrator account |
| Enable password encryption | Enabled |
| Configure authorized password decryptors | CORP\GG-LAPS-Readers |
| Configure size of encrypted password history | 3 |
| Post-authentication actions | reset the password and log off, grace period 8 hours |
| Do not allow password expiration time longer than required by policy | Enabled |
Who can read the password
The read right is equivalent to administrator rights on that machine, so it is granted along the tiering model:
- support staff read workstation passwords, but not server passwords,
- server administrators read application server passwords, but not domain controller passwords,
- Tier 0 machine passwords are read only by Tier 0 administrators.
In practice this means a separate organisational unit and a separate Group Policy object per tier, because the list of authorised decryptors is a policy setting, not a property of the unit.
Reading the password and post-use actions
The password of a specific machine is read with Get-LapsADPassword, or on the LAPS tab in the computer object’s properties in the Users and Computers console.
Get-LapsADPassword -Identity PC-0142 -AsPlainTextComputerName : PC-0142
DistinguishedName : CN=PC-0142,OU=Workstations,OU=Computers,DC=corp,DC=example,DC=com
Account : Administrator
Password : (password)
PasswordUpdateTime : 2026-10-02 07:14:31
ExpirationTimestamp : 2026-11-01 07:14:31
Source : EncryptedPassword
DecryptionStatus : Success
AuthorizedDecryptor : CORP\GG-LAPS-ReadersWhen a machine does not store its password
A machine processes LAPS policy every hour and records each attempt in the Microsoft-Windows-LAPS/Operational log. Most problems have one of a handful of causes.
| Symptom | Most common cause |
|---|---|
Active computer with no msLAPS-PasswordExpirationTime value | the policy does not cover its OU, or GPO security filtering skips it |
| Directory write error in the LAPS log | no Set-LapsADComputerSelfPermission for the OU the computer is in |
| Password expired weeks ago | machine switched off or off the network, with no contact with a domain controller |
| Support sees the object but not the password | the group has the read right but is not an authorised decryptor |
Password in the ms-Mcs-AdmPwd attribute instead of the new ones | the account is still handled by the older LAPS version |
On the machine itself, diagnosis starts with the log, and once the cause is fixed you can force immediate policy processing instead of waiting for the next cycle. Reset-LapsPassword changes the password at once, which is useful after an incident on that machine. From a server, without logging on to the computer, the same is achieved with Set-LapsADPasswordExpirationTime -Identity PC-0142: the password changes in the next processing cycle.
# Latest LAPS errors and warnings
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-LAPS/Operational'; Level = 2, 3 } -MaxEvents 20 |
Select-Object TimeCreated, Id, Message
# Process LAPS policy immediately
Invoke-LapsPolicyProcessing
# Change the managed account password immediately
Reset-LapsPasswordComplements
- Block network logon with local accounts. The “Deny access to this computer from the network” right with the identifier
S-1-5-114(local account and member of Administrators group) means that even a known local password does not allow logon over the network. The local administrator is for console work when the machine has lost contact with the domain. - Domain controllers. The “Enable password backup for DSRM accounts” setting lets LAPS manage the directory services restore mode password. That password is needed for directory recovery, so an automatic backup of it has real value.
- Migrating from the older version. The two versions must not manage the same account at the same time. The transition is planned per organisational unit: new policy on, old one off, verification that machines write passwords to the
msLAPS-*attributes.
Check your own environment
Active computers without a LAPS password. A good result is empty. A computer with a recent LastLogonDate on this list is a real gap; a computer that has not logged on for months is a candidate for directory clean-up, not for a LAPS fix.
$searchBase = 'OU=Computers,DC=corp,DC=example,DC=com'
Get-ADComputer -SearchBase $searchBase -Filter 'Enabled -eq $true' -Properties 'msLAPS-PasswordExpirationTime', LastLogonDate, OperatingSystem |
Where-Object { -not $_.'msLAPS-PasswordExpirationTime' } |
Sort-Object LastLogonDate -Descending |
Select-Object Name, OperatingSystem, LastLogonDatePasswords expired for more than 7 days. A machine in contact with a domain controller changes its password within an hour of expiry, so every entry is a computer off the network or with an error visible in the LAPS log.
$searchBase = 'OU=Computers,DC=corp,DC=example,DC=com'
$limit = (Get-Date).AddDays(-7).ToFileTimeUtc()
Get-ADComputer -SearchBase $searchBase -Filter 'Enabled -eq $true' -Properties 'msLAPS-PasswordExpirationTime' |
Where-Object { $_.'msLAPS-PasswordExpirationTime' -and $_.'msLAPS-PasswordExpirationTime' -lt $limit } |
Select-Object Name, @{ n = 'Expired'; e = { [datetime]::FromFileTimeUtc($_.'msLAPS-PasswordExpirationTime') } }Who can read passwords in a given organisational unit. The list should contain only NT AUTHORITY\SYSTEM, Domain Admins and the read group for that tier. Any other entry, such as an inventory tool account or a former support group, has full administrative access to every machine in that OU.
Find-LapsADExtendedRights -Identity 'OU=Workstations,OU=Computers,DC=corp,DC=example,DC=com'