Skip to content

LAPS Overview

Windows Server Security Hardening and GPO
LAPS Implementation for Password Management

Local Administrator Password Solution (LAPS) is a Microsoft tool designed to securely manage and store local administrator passwords on Windows devices within an Active Directory environment. It addresses the risk of hard-coded or static passwords for service accounts by dynamically generating, encrypting, and storing these passwords in Active Directory (AD). LAPS ensures that local admin credentials are isolated from domain accounts, reducing exposure to credential theft and unauthorized access.

Architecture Overview

LAPS operates through a distributed architecture with three core components:
1. LAPS Client: Installed on Windows devices (Windows 10/1607 or later, Windows Server 2016 or later). Generates a random password for the local Administrator account and stores it in AD.
2. LAPS Service: Runs on domain controllers (DCs) and manages password generation, encryption, and retrieval. It interacts with the LAPS client to enforce policies and store passwords securely.
3. LAPS Database: Passwords are stored as encrypted objects in AD, specifically in the lAPSPassword class. Access is restricted to authorized users and services.

The LAPS client communicates with the LAPS service via RPC, ensuring passwords are never transmitted in plaintext. Administrators use the LAPS Management Console (via PowerShell or GUI) to view and manage passwords.

Prerequisites

To implement LAPS, the following must be in place:
- Windows Server 2016 or later: For domain controllers running the LAPS service.
- Active Directory Domain Services (AD DS): LAPS relies on AD for secure password storage.
- Windows 10/1607 or later: For client devices requiring LAPS.
- Group Policy Objects (GPOs): Used to deploy LAPS settings (e.g., password complexity, retention policies).
- Microsoft Online Services Sign-in Assistant: Required for some LAPS client configurations.

Example: Enable LAPS via GPO:

Set-GPRegistryValue -Name "LAPS GPO" -Key "HKLM\SOFTWARE\Policies\Microsoft\Windows\LAPS" -ValueName "EnableLAPS" -Type DWord -Value 1

Role in Securing Service Account Passwords

LAPS replaces static passwords with dynamic, randomly generated credentials for local admin accounts. Key benefits include:
- Isolation: Local admin passwords are separate from domain accounts, preventing lateral movement in case of domain compromise.
- Encryption: Passwords are stored in AD as encrypted objects, accessible only to authorized users.
- Auditability: Passwords are retained for a configurable period (default: 100 days), with logs tracking access and changes.
- Integration: Works with Azure AD, third-party password managers, and GPOs for centralized management.

By automating password generation and storage, LAPS reduces the risk of credential exposure while maintaining compliance with security policies.

Key takeaways

  • LAPS secures local admin passwords by storing them encrypted in AD, isolated from domain accounts.
  • Requires Windows Server 2016+ for DCs and Windows 10/1607+ for clients.
  • Deploys via GPOs and integrates with AD for centralized management.
  • Reduces risks of credential theft and unauthorized access through dynamic password generation.
  • Passwords are accessible only to authorized users and services, with audit trails for accountability.