ReadLAPSPassword
This abuse can be carried out when controlling an object that has GenericAll or AllExtendedRights (or combination of GetChanges and (GetChangesInFilteredSet or GetChangesAll) for domain-wise synchronization) over the target computer configured for LAPS. The attacker can then read the LAPS password of the computer account (i.e. the password of the computer's local administrator).
This page is about LAPS-based attacks, you may have a look on LAPS-based persistences and LAPS enumeration.
Legacy LAPS vs Windows LAPS
| Variant | Password attribute | Expiration attribute |
|---|---|---|
| Legacy LAPS (Microsoft LAPS v1) | ms-Mcs-AdmPwd (cleartext) | ms-Mcs-AdmPwdExpirationTime |
| Windows LAPS (built-in, Win11 22H2 / Server 2025+) | msLAPS-Password (cleartext), msLAPS-EncryptedPassword (DPAPI-NG) | msLAPS-PasswordExpirationTime |
Windows LAPS also introduces a dedicated "Read LAPS password" extended right. In modern environments check for both attribute sets, e.g. (|(ms-Mcs-AdmPwd=*)(msLAPS-Password=*)(msLAPS-EncryptedPassword=*)).
From UNIX-like systems, pyLAPS (Python) can be used to retrieve LAPS passwords.
pyLAPS.py --action get -d 'DOMAIN' -u 'USER' -p 'PASSWORD' --dc-ip 192.168.56.101Alternatively, NetExec also has this ability
# Default command
netexec ldap $DOMAIN_CONTROLLER -d $DOMAIN -u $USER -p $PASSWORD --module laps
# The COMPUTER filter can be the name or wildcard (e.g. WIN-S10, WIN-* etc. Default: *)
netexec ldap $DOMAIN_CONTROLLER -d $DOMAIN -u $USER -p $PASSWORD --module laps -O computer="target-*"Impacket's ntlmrelayx also carries that feature, usable with the --dump-laps.
LAPSDumper is another Python alternative.