Tools · Windows security and Event Logs · 22 / 27
Windows LAPS: unique local administrator passwords on every machine
Understand why shared local admin passwords enable lateral movement, enable built-in Windows LAPS, and retrieve and rotate a password safely.
One password, every machine
Many organizations image every workstation with the same local Administrator password. If an attacker extracts that password or its hash from one machine, they can log in as administrator to every other machine with it. This is one of the most common paths for lateral movement.
Local Administrator Password Solution gives each machine a unique, random password that rotates on a schedule and is stored in Active Directory or Microsoft Entra ID, readable only by authorized groups.
Windows LAPS is built in
Since April 2023 updates, Windows LAPS is built into Windows 10, Windows 11, and Windows Server 2019 and later. For Active Directory, extend the schema with Update-LapsADSchema, grant computers permission to update their own password with Set-LapsADComputerSelfPermission on the right OU, and enable it through Group Policy or Intune. Password encryption and history are supported with a Windows Server 2016 domain functional level or later.
Restrict read access to the password attribute to a small helpdesk or admin group.
Update-LapsADSchema Set-LapsADComputerSelfPermission -Identity "OU=Workstations,DC=lab,DC=local" # GPO: Computer Configuration > Administrative Templates > System > LAPS # Configure password backup directory = Active Directory # Password Settings: complexity, length 20, age 30 days
Lab: retrieve and rotate
In a lab domain, enable the policy for one OU, run gpupdate on a member workstation, and trigger an immediate update with Invoke-LapsPolicyProcessing. Retrieve the password from a management machine with Get-LapsADPassword, then force a rotation with Reset-LapsPassword on the client and confirm the value changed.
Check the LAPS event log on the client, Microsoft-Windows-LAPS/Operational, for processing and errors.
Invoke-LapsPolicyProcessing Get-LapsADPassword -Identity WS01 -AsPlainText Reset-LapsPassword # on the client Get-WinEvent -LogName Microsoft-Windows-LAPS/Operational -MaxEvents 10 | Format-Table TimeCreated, Id, Message -Wrap
Go further
Configure post-authentication actions so the password rotates and the session is logged off after someone uses it. Audit reads of the password attribute so you know who retrieved which machine’s password.
Combine LAPS with restricting network logon for local accounts using the “Deny access to this computer from the network” right for the Local account group, which blocks pass-the-hash with local accounts entirely.
Diagram
Shared versus unique local admin passwords
What one stolen credential is worth.
One machine compromised. Every machine is reachable as admin.
Rotation. Rare and painful.
Visibility. Nobody knows who knows it.
One machine compromised. Only that machine’s password exposed.
Rotation. Automatic on schedule and after use.
Visibility. Reads are restricted and auditable.
Check yourself
1. What problem does LAPS solve?
2. Which cmdlet retrieves a machine’s LAPS password from AD?
3. Which setting blocks pass-the-hash with local accounts across the network?