| Table of Contents | ||||
|---|---|---|---|---|
|
...
Windows LAPS | Legacy LAPS | |
|---|---|---|
Password-management bits | Included with the April 2023 Cumulative Update for Windows | The client-side extension must be installed on each computer. |
Frequency of processing the LAPS policy cycle | This is hard-coded in Windows to 1 hour | Since this was a Group Policy Client-side extension, this was done at the same time as a group policy refresh. |
Configuration options | Group Policy Configuration Service Provider (such as Intune - but this option is currently not available at the University) | Group Policy |
Group Policy settings location | Computer Configuration - Policies - Administrative Templates - System - LAPS | Computer Configuration - Policies - Administrative Templates - LAPS |
Where is the password stored in AD | All Windows LAPS attributes are confidential attributes: msLAPS-PasswordExpirationTime: This is a regular attribute that stores the date and time that the LAPS password will expire / when it will be reset, calculated by adding the value of the Password Age (Days) setting to the time the password was last set msLAPS-Password: A clear-text string that contains the name of the managed account, the timestamp of the password update, and the current password msLAPS-EncryptedPassword: The encrypted current password msLAPS-EncryptedPasswordHistory: Contains the encrypted previous passwords (it will store as many of the previous passwords as it is configured to, which allows for a maximum of 12) msLAPS-EncryptedDSRMPassword: This setting only pertains to Domain Controllers. msLAPS-EncryptedDSRMPasswordHistory: This setting only pertains to Domain Controllers. | ms-mcs-AdmPwd: This is a confidential attribute where the password is stored ms-mcs-AdmPwdExpirationTime: This is a regular attribute that stores the date and time that the LAPS password will expire / when it will be reset, calculated by adding the value of the Password Age (Days) setting to the time the password was last set |
Is the password that is stored in Active Directory encrypted? | It depends on the LAPS policy in use when the password is saved in AD. | No, it is never encrypted |
Where can the password be backed up to? | Windows Server (on-prem) Active Directory or Azure Active Directory.
| Windows Server Active Directory only. |
Who can access the password in AD | If the password is not encrypted (msLAPS-Password) you must have access to the confidential attribute in AD. If the password is encrypted (msLAPS-EncryptedPassword, msLAPS-EncryptedPasswordHistory) you must have access to the confidential attribute in AD AND be an authorized password decryptor (refer to the Windows LAPS Policy Settings section below). | You must have access to the confidential attribute in AD. |
Access to the confidential attribute is available with any of the following delegations:
| ||
...
Setting | Description |
|---|---|
Password Settings | If enabled, you can configure the following aspects of the password that is generated: Password Complexity: Determines what type of characters are used to generate the password. The available options are:
The default is Large letters + small letters + numbers + specials. Password Length: Determines how many characters the password will be in length. This must be a number from 8 - 64. The default value is 14. Password Age (Days): This is the number of days that will be used to set the password expiration time. This must be a number from 1 - 365. The default value is 30. Passphrase Length (words): This is the number of words that will be used in the passphrase (when Password Complexity is set to a passphrase option). This must be a number from 3 - 10. The default value is 6. |
Name of administrator account to manage | The name of the local administrator account whose password is managed. Only set this if you want Windows LAPS to manage an account other than the built-in Administrator. The default, when not specified, is the built-in Administrator (by its well-known RID). |
Configure automatic account management | This option is only applicable starting with 24H2 operating systems (Windows 11 24H2 and Server 2025). When enabled, this takes precedence over the Name of administrator account to manage setting. If enabled, you can configure the following aspects of the managed account: Specify the target account to manage: Two options are available:
Automatic account name (or name prefix): The name of the account that Windows LAPS will manage the password for (or the prefix on the name of the account if Randomize the name of the managed account is checked.) Enable the managed account (checkbox): If checked, the account will be enabled by LAPS. If unchecked, the account will be disabled by LAPS. Randomize the name of the managed account (checkbox): If checked, the Automatic account name (or name prefix) will be treated as a prefix; a suffix of eight random numbers will be added to it. The name will also be randomized every time the password is changed. If unchecked, the Automatic account name (or name prefix) will be treated as the account name. |
Enable password encryption | If enabled, the password is encrypted before it is backed up to AD. If disabled, the password is not encrypted before it is backed up to AD. If not configured, the default value is Enabled. |
Enable password backup for DSRM accounts | This setting only pertains to Domain Controllers. |
Do not allow password expiration time longer than required by policy | If enabled, LAPS will adhere to the computer's password settings policy and the password will be reset when the password has expired based on the computer's password settings policy. The new expiration is then set so it adheres to the computer's password settings policy. If disabled, the expiration of the password set by LAPS could exceed the requirement of the computer's password settings policy. If not configured, the default value is Enabled. |
Configure size of encrypted password history | If enabled, you can specify how many older encrypted passwords to store in AD. This must be a number from 0 - 12. This setting only applies when encrypted passwords are being backed up to AD. This setting may help out when reverting to a VM snapshot where an older password was in use at the time the snapshot was taken. |
Configure password backup directory | Determines where the password is backed up to. Options:
The default value when not specified is 0 (the password will not be backed up or managed by LAPS). Note: "2: Windows Server (on-prem) AD only" is the only supported option at the University at this time. |
Configure authorized password decryptors | When enabled, you will specify the user or group that is authorized to decrypt the encrypted password in AD. You must provide one of the following as the decryptor
Warning: If the device cannot resolve the SID or name provided, the password will not be backed up. This setting only applies when encrypted passwords are being backed up to AD. The default value when not specified is the Domain Admins group. |
Post-authentication actions | Specify an action that will be triggered after the successful authentication of the account whose password is being managed. The available actions are:
Set the grace period to the time you want it to wait after the authentication before the action is triggered. The grace period must be set greater than 0; if set to 0 the action will not be triggered. If this setting is disabled or not configured, the default behaviour will apply which is to reset the password and logoff the managed account after 24 hours. |
...
Open the Properties for the computer.
Select the LAPS tab.
On the LAPS tab of the computer's Properties page:
The Current LAPS password expiration is displayed.
You can specify a new password expiration.
After specifying the new expiration click OK or Apply.You can make the password expire now by clicking on the Expire now button and then clicking on OK or Apply.
This will set the expiration to the current date and time.
The password will not actually be changed immediately on the computer, but when it next processes LAPS policy.The LAPS local admin account name is displayed.
The LAPS local admin account password is masked by default
Clicking Copy password will put the clear-text password on your clipboard without unmasking it here.
Clicking Show password will display the password in clear text here.
Note: You cannot view the password history from here. You must use PowerShell to access the password history.
...
Open the properties for the computer.
Scroll down to the Extensions.
Select the LAPS tab.
The LAPS tab is available just as it would appear in ADUC. Refer to the ADUC section above for details.
...
Use the Get-LapsPassword cmdlet
Get-LapsADPassword -Identity <computername>
will return the current password in a Secure String object.The Account property shows the managed account name.
The Password property contains the password.
The PasswordUpdateTime shows when the password was updated.
The ExpirationTimestamp shows when the current password expires/when a new password will be required.
The DecryptionStatus property will show Success if you are allowed to decrypt the password. It will show Unauthorized if you are not.
The AuthorizedDecryptor property will show the user or group that can decrypt the password.
Note: When using tab-completion it is easy to accidentally run the Get-LapsAADPassword instead. This is the cmdlet used to retrieve the password from Azure Active Directory.
Or to get the password in cleartext
Get-LapsAdPassword -Identity <computername> -AsPlainText
will return the current password in plain text.Or to get the password history in plain text
Get-LapsAdPassword -Identity <computername> -AsPlainText -IncludeHistory
will return the password history in plain textThe number of passwords in the password history depends on the LAPS policy applied and how many times the password has been changed by LAPS.
Each password in the password history can have a different Authorized Decryptor, depending on what was specified in the policy when the password was encrypted and stored in AD.
The AuthorizedDecryptor shows who can decrypt the password.
The DecryptiomStatus shows whether the password was successfully decrypted for the user running the cmdlet.In this example, the user running the cmdlet can see the latest password as they are a member of the Authorized Dectryptors. They cannot see the previous password as the Authorized Dectryptors for it is a different group that the user is not a member of.
...
Cmdlet | Description |
|---|---|
Get-LapsAdPassword | Gets the escrowed password(s) from Windows Server Active Directory. |
Invoke-LapsPolicyProcessing | Initiates the processing of the current LAPS policy, independent of the hourly processing cycle). |
Reset-LapsPassword | Attempts to immediately change the managed account's password (whether or not it has expired). |
...