LAPS (Local Administrator Password Solution) is a free and helpful tool that Microsoft recommends for local administrator password management.
Below you will find a step-by-step walkthrough to install and configure LAPS.
Note: If you run these steps on a domain controller, ensure that nothing in the environment is using the default Domain Administrator account by checking authentication logs (event_id’s 4624, 4625, 4776). Installing LAPS on a DC will automatically change the password for the default administrator account to a random string.
Step 1: Download the LAPS msi file from Microsoft https://www.microsoft.com/en-us/download/details.aspx?id=46899
Step 2: Create a share with .msi file for domain users and COMPUTERS. This share will need to be read accessible from the users and computers that the GPO is applied to, so if you already have a share that is being used for this purpose, that would be a good candidate. If you are not deploying the package with a GPO, you can skip this step.
Step 3: Create a new GPO, or use an existing GPO to configure and deploy as a software package to domain-joined computers. You may also use whatever other software that you manage remote software rollout with.
Step 4: Edit the GPO. Computer Configuration > Policies > Software Settings. Right click on Software Installation and click New > Package. = \\TEST-DC\RandomFileShare
Step 5: Leave the “Deploy Software” options default, and click OK.
Step 1: Open PowerShell on a Domain Controller (DC)
Import-module AdmPwd.PS
Update-AdmPwdADSchema
Set-AdmPwdComputerSelfPermission -OrgUnit “Endpoints”
Find-AdmPwdExtendedrights -identity “Endpoints”
Remember, you can plan these out so different user groups have access to different endpoint OUs in Active Directory. It’s not an “everyone gets admin” type of situation.
a. Edit these by navigating to Cmd > and typing adsiedit
b. If a domain isn’t listed, right click on ADSI Edit > Connect to.. > and select your domain
c. Right click OU > Properties > Security > Advanced
e. Navigate to the permissions below and set to the desired settings:
Step 5: Add the ability of a user or group to retrieve a computer’s password. In this example, we’ll allow the PowerGroup to retrieve the passwords from any device in the Endpoints OU
When you check permissions again, you see the PowerUsers is now listed.
Step 1: To apply the password security and enable LAPS, you can modify this setting in the GPO you’ve already created for LAPS, or wherever makes sense in your organization’s structure.
Step 1: Show password with PowerShell
get-admpwdpassword -computername “test-win10”One of the most detrimental misconfigurations on a Windows network is setting the same password for all local administrator accounts. It happens everywhere. Even if you’ve streamlined your endpoint rollouts with imaging software, it’s just easier to make that admin login the same across the organization. The support staff and management software can use it without needing to worry about remembering a password schema. Who else can benefit from this ease of configuration? Malicious actors, worms, viruses, ransomware just to name a few.
Once a password hash has been stolen, it can be used over and over again on any computer that has that same user/password locally. A common tool for this credential stealing is Mimikatz, a tool that can dump passwords and other authentication methods such as kerberos tickets out of memory and use those to escalate from a normal under-privileged account to an administrator account.
The primary defense against Mimikatz (and other privilege escalation) is limiting administrative privileges to only those users that need it. That’s definitely easier said than done, especially in an enterprise environment that has been around for a long time. It’s common to start at a company where you find a network that was built without design or security in mind. Many times least privilege wasn’t a consideration when a piece of software or business function just needed to work.
Luckily in 2015 Microsoft came up with an integrated solution for this. LAPS enables admins to manage the local account passwords of domain-joined computers.
LAPS protects these passwords by storing them in an access-control list (ACL) within AD (Active Directory), so only users with access rights can read or request a password reset.
Before you install LAPS, ensure that you meet the following prerequisites:
Management Tools:
OS Requirements:
Active Directory Requirements:
Our Free edition is made for Microsoft environments to see how easy it is to deploy, and how teams can start seeing immediate security value for their organizations.No credit card or additional M365 licensing required.
