LAPS
Theory
The "Local Administrator Password Solution" (LAPS) provides management of local account passwords of domain joined computers. Passwords are stored in Active Directory (AD) and protected by ACL, so only eligible users can read it or request its reset.
This page is about enumeration, you may have a look on LAPS-based attacks and LAPS-based persistences.
Legacy LAPS vs Windows LAPS
| Variant | Password attribute | Expiration attribute |
|---|---|---|
| Legacy LAPS (Microsoft LAPS v1) | ms-Mcs-AdmPwd (cleartext) | ms-Mcs-AdmPwdExpirationTime |
| Windows LAPS (built-in, Win11 22H2 / Server 2025+) | msLAPS-Password (cleartext), msLAPS-EncryptedPassword (DPAPI-NG) | msLAPS-PasswordExpirationTime |
Windows LAPS also introduces a dedicated "Read LAPS password" extended right. In modern environments check for both attribute sets, e.g. (|(ms-Mcs-AdmPwd=*)(msLAPS-Password=*)(msLAPS-EncryptedPassword=*)).
Practice
Check If Activated
We can check if LAPS is installed by enumerating related files and folders
# Identify if installed to Program Files
# PowerShell
Get-ChildItem 'C:\Program Files\LAPS\CSE\'
Get-ChildItem 'C:\Program Files (x86)\LAPS\CSE\'
#Cmd
dir 'C:\Program Files\LAPS\CSE\'
dir 'C:\Program Files (x86)\LAPS\CSE\'LAPS GPO Configuration
By reading the GPO configuration file, you may retreive following informations: Password complexity, Password length, Password chage frenquency, the LAPS managed account name, and password expiration protection policy.
If LAPS is deployed by GPO, we can identify the configuration file to discover some details about the configuration.
Get-Content "<GPCFileSysPath>\Machine\Registry.pol"After downloading the GPO registry.pol file which location is at the gpcfilesyspath obtained while enumerating GPOs, we can useParse-PolFile from GPRegistryPolicyParser and obtain LAPS related informations.
Parse-PolFile "Registry.pol"LAPS Read Password Access
You may enumerate principals that can read the LAPS password on given systems by using Powerview, admpwd.ps, or even adsisearcher.
We can enumerate who can read the LAPS password using Powersploit's Powerview.
# Find the principals that have ReadPropery on ms-Mcs-AdmPwd for a giver computer
Get-AdmPwdPassword -ComputerName computer01 | fl
# Find the principals that have ReadPropery on ms-Mcs-AdmPwd for each computers
Get-DomainComputer | Get-DomainObjectAcl -ResolveGUIDs | ? { $_.ObjectAceType -eq "ms-Mcs-AdmPwd" -and $_.ActiveDirectoryRights -match "ReadProperty" } | ForEach-Object { $_ | Add-Member NoteProperty 'IdentityName' $(Convert-SidToName $_.SecurityIdentifier); $_ }
# Find the principals that have ReadPropery on ms-Mcs-AdmPwd for each OU
Get-DomainOU | Get-DomainObjectAcl -ResolveGUIDs | Where-Object {($_.ObjectAceType -like 'ms-Mcs-AdmPwd') -and ($_.ActiveDirectoryRights -match 'ReadProperty')} | ForEach-Object { $_ | Add-Member NoteProperty 'IdentityName' $(Convert-SidToName $_.SecurityIdentifier); $_ }Resources
LAPS | Pentest Everythingviperone.gitbook.io
LAPS - Part 1buaq.net
LAPS - HackTricksbook.hacktricks.xyz