---
title: "Secure Windows Admin Passwords with Microsoft LAPS"
description: "Implement Microsoft LAPS to protect local Windows admin passwords and enhance your organization's security posture."
canonical: "https://adamtheautomator.com/microsoft-laps/"
---

# Secure Windows Admin Passwords with Microsoft LAPS

> Implement Microsoft LAPS to protect local Windows admin passwords and enhance your organization's security posture.

Source: https://adamtheautomator.com/microsoft-laps/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![Secure Windows Admin Passwords with Microsoft LAPS](https://adamtheautomator.com/wp-content/uploads/2020/04/fabian-gieske-zWlMTSA3uvk-unsplash.jpg)

# Secure Windows Admin Passwords with Microsoft LAPS

[![](https://secure.gravatar.com/avatar/f60574d4bd6fddeac77731265286c1746662129f38c23248eb7d53d4084503d6?s=192&d=mm&r=g)Alex Asplund](https://adamtheautomator.com/author/alex/)14 April 202011 min. read

Categories: [IT Ops](/category/it-ops/)

Tags:[Microsoft LAPS](/tag/microsoft-laps/)[Password Management](/tag/password-management/)

Table of Contents

*   [What is Microsoft LAPS?](#what-is-microsoft-laps)
*   [LAPS in Practice](#laps-in-practice)
*   [Locked-Down AD Attributes](#locked-down-ad-attributes)
*   [GPO Settings](#gpo-settings)
*   [Setting up LAPS](#setting-up-laps)
*   [Prerequisites](#prerequisites)
*   [Installing Microsoft LAPS Management Tools](#installing-microsoft-laps-management-tools)
*   [Extending the AD Schema](#extending-the-ad-schema)
*   [Configuring Active Directory Permissions](#configuring-active-directory-permissions)
*   [Allowing Machines to Save Their Password](#allowing-machines-to-save-their-password)
*   [Locking Down AD Attributes by Finding Extended Rights](#locking-down-ad-attributes-by-finding-extended-rights)
*   [Removing Extended Rights](#removing-extended-rights)
*   [Giving Permission to Read and Reset the Local Administrator Password](#giving-permission-to-read-and-reset-the-local-administrator-password)
*   [Creating a Central Store for Group Policy templates](#creating-a-central-store-for-group-policy-templates)
*   [Creating the GPO](#creating-the-gpo)
*   [Deploying LAPS GPO extension](#deploying-laps-gpo-extension)
*   [Deploying the LAPS MSI with a GPO](#deploying-the-laps-msi-with-a-gpo)
*   [Testing LAPS](#testing-laps)
*   [Tips and tricks for Using LAPS for Real](#tips-and-tricks-for-using-laps-for-real)
*   [1\. Turn on Auditing](#1-turn-on-aauditing)
*   [2\. Ensure No User Can Directly Read the ms-mcs-AdmPwd AD Attribute](#2-ensure-no-user-can-directly-read-the-ms-mcs-admpwd-ad-attribute)
*   [3\. Reset the Ms-Mcs-AdmPwdTime Attribute During Disk Imaging](#3-reset-the-ms-mcs-admpwdtime-attribute-during-disk-imaging)
*   [4\. Remember the ms-Mcs-AdmPwd Attribute Stays in the AD Recycle Bin](#4-remember-the-ms-mcs-admpwd-attribute-stays-in-the-ad-recycle-bin)
*   [5\. LAPS is Not for Temporary Access](#5-laps-is-not-for-temporary-access)
*   [Conclusion](#conclusion)

How do you currently handle local [Windows](https://adamtheautomator.com/new-windows-terminal/) administrator passwords? Every Windows system has one and they have the keys to the kingdom of each PC. Since local admin passwords are not part of [Active Directory](https://adamtheautomator.com/tag/active-directory/) (AD), you must manage each account on every computer separately. It’s a pain.

Much of the time, organizations don’t think too much of it and just set a standard administrator password on each Windows machine. This practice, although convenient, opens organizations up to a much bigger problem when that one, master password is put into the wrong hands. Having a separate local administrator password on each computer doesn’t necessarily prevent a malicious individual from accessing one PC but it prevents the lateral exploitation of other PCs considerably.

Microsoft Local Administrator Password Solution (LAPS) can help.

In this article, you’re going to learn how to secure your AD-joined computers by setting up LAPS.

## What is Microsoft LAPS?

LAPS is a vital part of keeping a Windows environment secure. LAPS is a tool that works in a clever way; it automatically randomizes the local administrator password on all domain computers with LAPS activated and changes each password regularly.

LAPS ensures that you have randomized local administrator passwords across your domain and prevents lateral movement from hackers and malware. Now, you might think that a long local administrator password on the client might protect you from this but it [that’s not true](https://www.varonis.com/blog/dealing-with-windows-local-administrator-accounts-part-ii/).

Hackers can use a [Pass-The-Hash](https://www.varonis.com/blog/dealing-with-windows-local-administrator-accounts-part-ii/) method to rapidly spread through your domain and might even come across a domain admin credential by using the same method. LAPs prevents this activity by forcing malicious individuals to discover a password for each, individual machine.

## LAPS in Practice

LAPS has three main parts:

### Locked-Down AD Attributes

LAPS stores each local administrator password for every controlled computer in AD called _ms-Mcs-AdmPwd_. LAPS also needs to know when the passwords expire to change it so it also stores another AD attribute called _ms-Mcs-AdmPwdExpirationTime_. These AD attributes are only read/writeable by specified AD principals like a group or a user and also writable by the computer account that’s using the password.

### GPO Settings

To provision LAPS on a computer and to change the password LAPS also has a set of GPO settings. When the GPO is linked to a set of computers, the LAPS settings are distributed to each computer. When the computer applies GPO settings, LAPS uses a special DLL file to interpret them.

When LAPS see that the current date is past the expiration date of the password it will:

*   Randomize a new password and set it as the local administrator password.
*   Write the new local administrator password to the _Ms-Mcs-AdmPwd_ attribute in AD.
*   Writes a new expiration date to _ms-Mcs-AdmPwdExpirationTime_.

By using this clever yet simple method the domain computers stays even more secure.

## Setting up LAPS

Enough information, let’s get down to actually seeing what LAPS can do! Setting up LAPS is not complicated but does require a few steps you’re going to learn in this tutorial. They are:

1.  Installing the LAPS Management Tools on your admin machine.
2.  Extending the AD schema to add the two custom AD attributes LAPS uses.
3.  Setting appropriate privileges for various components in AD.
4.  Building the LAPS GPO that will get applied to Windows computers.
5.  Deploying the LAPS GPO Extension to applicable Windows computers.

Once you’re with the above steps, you will have a fully-functional LAPS environment set up and ready to go!

### Prerequisites

In this article, you’ll be setting up LAPS for real. If you’d like to follow along, please be sure you meet a few prerequisites first.

*   An AD Domain (2003 and upwards)
*   A computer running Windows (10 or Server 2012+ is recommended) has [RSAT for Active Directory](https://adamtheautomator.com/powershell-import-active-directory/#install-rsat-remote-server-administration-tools-) installed.
*   Have access to an account that is both a member of the AD Domain Admins and Schema Admins groups.

All examples in this article will be using an AD domain called _[contoso.com](http://contoso.com)_.

> _Best practice for the schema admin group is to only be a member of it when you need the permissions._

### Installing Microsoft LAPS Management Tools

To get started, you must first install the LAPS Management Tools on your admin computer. These management tools will install both the LAPS GPO extension (if selected) and the management tools to configure LAPS.

1.  Start by downloading the [_LAPS.x64.msi_](https://www.microsoft.com/en-us/download/details.aspx?id=46899) file and launch it as an admin and click **Next**.

![Installing Microsoft LAPS ](https://adamtheautomator.com/wp-content/uploads/2020/05/Untitled-2020-05-27T130310.089.png)

Installing Microsoft LAPS

2\.  Press **Next** until you come to the custom setup then click **Management Tools** and **Entire feature will be installed on local hard drive** to install both of these components. If you would not like the current machine to be managed by LAPS then select **AdmPwd GPO Extension**.

![Click Management Tools](https://adamtheautomator.com/wp-content/uploads/2020/05/Untitled-2020-05-27T130318.386.png)

Click **Management Tools**

3\.  Click **Next** until the install finishes and exit the installer.

You have now installed LAPS GPO extensions (if selected) and it’s management tools and we can now start extending the AD schema and adding our GPOs.

### Extending the AD Schema

As mentioned earlier, LAPS uses two AD attributes called _ms-Mcs-AdmPwd_ and _ms-Mcs-AdmPwdExpirationTime_. These two attributes are not default and must be added to the AD schema.

1.  Start out by adding a member of the _Domain Admins_ groups to the _Schema Admins_ group if the account is not already a member. We’ll call this your “admin account”.
2.  Start PowerShell as your admin account and import the _AdmPwd_ [PowerShell module](https://adamtheautomator.com/powershell-modules/ "PowerShell module") by executing `Import-module AdmPwd.PS`.
3.  Once the module is imported, run the command `Update-AdmPwdADSchema` to update the AD schema adding the two AD attributes. You can see the output in the following screenshot.

![Powershell Admin Account](https://adamtheautomator.com/wp-content/uploads/2020/05/Untitled-2020-05-27T130326.961.png)

Powershell Admin Account

You now extended our AD schema to support LAPS and are ready to set permissions in Active Directory.

### Configuring Active Directory Permissions

Each computer needs the ability to update their local administrator password and expiration time AD attribute. To do that, each computer must have self-write permission to the _ms-Mcs-AdmPwd_ and _ms-Mcs-AdmPwdExpirationTime_ AD attributes. Luckily most of this work is easily done with the AdmPwd PowerShell module.

#### Allowing Machines to Save Their Password

First, ensure each computer can save their password to the _ms-Mcs-AdmPwd_ AD attribute and update when that password expires in the _ms-Mcs-AdmPwdExpirationTime_ AD attribute. The AdPwd PowerShell module has a command you can set these permissions called `Set-AdmPwdComputerSelfPermission` by organizational unit (OU) which applies to all child OUs.

In PowerShell, run `Set-AdmPwdComputerSelfPermission -OrgUnit ‘OU=Workstations,DC=contoso,DC=com’` remembering to update your specific OU and domain name.

![Update OU and Domain Name](https://adamtheautomator.com/wp-content/uploads/2020/05/Untitled-2020-05-27T130344.067.png)

Update OU and Domain Name

> _If you’d like LAPS to control more OUs, repeat the above command for each OU in AD._

#### Locking Down AD Attributes by Finding Extended Rights

To ensure that only the users and groups that you want to have permissions to read and reset the local admin password of each computer, you need to audit who has access. Specifically, you need to know that only the accounts that needs to have “Extended rights” have it.

To find accounts with extended rights, run `Find-AdmPwdExtendedRights -OrgUnit 'OU=Workstations,DC=contoso,DC=com' | Select -ExpandProperty ExtendedRightHolders` ensuring to replace your OU and domain name.

You can now see in the following screenshot that _CONTOSO\\joe-the-admin_ and _CONTOSO\\MDT-service_ have extended rights to the _Workstations_ OU.

![Workstations OU](https://adamtheautomator.com/wp-content/uploads/2020/05/Untitled-2020-05-27T130359.803.png)

Workstations OU

The _MDT-service_ permission does indeed need the extended right, but _joe-the-admin_ does not. You now need to remove the permission for _joe-the-admin_.

> _You’ll need to repeat this process for all OUs that you set the self-write permission on in an earlier step._

#### Removing Extended Rights

Once you’ve identified each account to remove extended rights from, it’s now time to actually do it.

1.  Open **Active Directory Users And Computers** and click on **View** in the upper menu and ensure **Advanced Features** is enabled. When you enable advanced features, you’ll see all of the typically hidden OUs as shown in the following screenshot.

![Hidden OUs](https://adamtheautomator.com/wp-content/uploads/2020/05/Untitled-2020-05-27T130410.734.png)

Hidden OUs

2\. Right click on the OU that you want to remove the extended right on and click **Properties.**

![Right Click OU to Remove](https://adamtheautomator.com/wp-content/uploads/2020/05/Untitled-2020-05-27T130421.577.png)

Right Click OU to Remove

3\.  Click on the **Security** tab and then click the **Advanced** button.  
4\.  Find the account or group that you want to remove the extended rights for and remove it by selecting it and clicking on **Remove**.

![Security Tab for Account Removal](https://adamtheautomator.com/wp-content/uploads/2020/05/Untitled-2020-05-27T130431.401.png)

Security Tab for Account Removal

5\.  Repeat these steps as needed for all principals with extended rights.

#### Giving Permission to Read and Reset the Local Administrator Password

Now that you’ve made sure that only appropriate accounts have extended rights, you now need to to create two AD groups for reading and resetting the local admin password called _LAPS Workstations Password Read_ and _LAPS Workstations Password Reset_.

> _Note that the group names specified here are not mandatory. You are free to use any group name you please._

With a PowerShell console still open with your admin account, enter the following commands to give both AD groups permission to read the local administrator password for computers in the _Workstations_ OU.

```powershell
PS> Set-AdmPwdReadPasswordPermission -OrgUnit 'OU=Workstations,DC=contoso,DC=com' -AllowedPrincipals "LAPS Workstations Password Read"

PS> Set-AdmPwdResetPasswordPermission -OrgUnit 'OU=Workstations,DC=contoso,DC=com' -AllowedPrincipals "LAPS Workstations Password Reset" 
```

You’ve now enabled the AD groups above to read and reset local administrator passwords for computers in the _Workstations_ OU. You now need to add the administrators or groups required to read or reset the passwords.

### Creating a Central Store for Group Policy templates

For LAPS to enable itself once installed on the computers, first create a group policy by importing the group policy templates to the [_PolicyDefinition_ store](https://support.microsoft.com/en-us/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra). The _PolicyDefinition_ store is a folder located on all domain controllers.

> _Never enable a LAPS GPO that targets the domain controllers. It’s not supported and may cause unexpected problems._

1.  Pick out a domain controller in AD; any domain controller will work.
2.  Ensure a \\\\[contoso.com](http://contoso.com)\\SYSVOL\\Policies\\PolicyDefinitions exists. If not, create it now.
3.  Copy the contents of _C:\\Windows\\PolicyDefinitions_ on your admin computer (the one you installed LAPS on) to \\\\[contoso.com](http://contoso.com)\\SYSVOL\\Policies\\PolicyDefinitions folder on the domain controller.

### Creating the GPO

Now let’s copy the LAPS GPO templates to the Central Store (_PolicyDefinitions_ folder).

1.  Open **[Group Policy](https://adamtheautomator.com/what-is-group-policy/ "Group Policy") Management** under your admin account,right-click the OU you want to enable LAPS in and click **Link an Existing GPO…**

![Group Policy Management](https://adamtheautomator.com/wp-content/uploads/2020/05/Untitled-2020-05-27T130442.168.png)

Group Policy Management

2\.  Navigate to **Computer Configuration —**\> **Administrative Templates —**\> **LAPS** and [set **Enable local admin password management**](https://adamtheautomator.com/powershell-scheduled-task/) to **Enabled.** If you have different requirements for Password complexity, edit the **Password Settings** accordingly.

![Linking GPO to all OUs](https://adamtheautomator.com/wp-content/uploads/2020/05/Untitled-2020-05-27T130455.785.png)

Linking GPO to all OUs

You’re almost done! Now link this GPO to all OUs that you want to use LAPS in.

### Deploying LAPS GPO extension

Once the GPO is applied to all applicable OUs with computers in them, you now need to deploy the LAPS GPO extension. You’ve got a couple of different ways to install this extension by either installing the MSI (as shown earlier) or by registering the LAPS DLL file.

If you choose to install the MSI, on every computer inside of a LAPS-controlled OU, run the following command to enable LAPS.

```powershell
> msiexec /q /i \\server\share\LAPS.x64.msi
```

If you choose to enable LAPS by registering the DLL, you can do so with the following command.

```powershell
> regsvr32.dll \\server\share\AdmPwd.dll
```

You can use any remote execution tool you have to run these commands on the computers.

### Deploying the LAPS MSI with a GPO

Using a GPO is the easiest method to ensure that the LAPS GPO extension is installed on all computers.

1.  Copy _LAPS.x64.msi_ to a network share accessible by all Domain Computers.
2.  Open **Group Policy Management** on your admin computer and create a GPO called _Install LAPS_ or something similar.

![Creating GPO called Install LAPS](https://adamtheautomator.com/wp-content/uploads/2020/05/Untitled-2020-05-27T130506.070.png)

Creating GPO called Install LAPS

3\.  Right-click on the _Install LAPS_ GPO, click **Edit** and navigate to **Computer Configuration** —> **Policies** —> **Software Settings** —> **Software Installation.**

![LAPS GPO Software Installation](https://adamtheautomator.com/wp-content/uploads/2020/05/Untitled-2020-05-27T130518.219.png)

LAPS GPO Software Installation

4\.  Right-click on **Software Installation** and navigate to **New—**\> **Package…**

![GPO New Package](https://adamtheautomator.com/wp-content/uploads/2020/05/Untitled-2020-05-27T130527.804.png)

GPO New Package

5\.  Navigate to the share that you copied _LAPS.x64.msi,_ select it, click **OK** and select **Assigned.**

![Assigning LAPS.x64.msi](https://adamtheautomator.com/wp-content/uploads/2020/05/Untitled-2020-05-27T130536.484.png)

Assigning LAPS.x64.msi

6\.  Now link the GPO to the same OUs as you configured LAPS for. You’re now ready to test LAPS!

### Testing LAPS

To ensure that LAPS is working as designed on the controlled computers, let’s now force one of the computers to apply the aforementioned GPO and see what happens.

1.  Restart a computer that’s located under one of the OUs you just configured. Once up again, the computer should begin installing LAPS.
2.  Once LAPS installs on the computer, reboot the machine once again and open up a PowerShell console as administrator on your admin computer as an account that’s a member of the _LAPS Workstation Password Read_ and _LAPS Workstation Password Reset_ AD groups .
3.  Run the `Get-AdmPwdPassword <computername>` command using the computer name you had just rebooted and installed LAPS on. If all went well, you will see something similar to the output in the following screenshot.

![LAPS Installation Output](https://adamtheautomator.com/wp-content/uploads/2020/05/Untitled-2020-05-27T130545.861.png)

LAPS Installation Output

4\.  Now try to log into the LAPS-controlled computer with the displayed password above. If it worked, you should be in.  
5\.  Now try to reset the password by running `Reset-AdmPwdPassword <ComputerName>` and rebooting the computer. See how it changed passwords in the following screenshot?

![LAPS Password Reset](https://adamtheautomator.com/wp-content/uploads/2020/05/Untitled-2020-05-27T130555.960.png)

LAPS Password Reset

You now have LAPS working in your environment. And while the administration is quite easy there’s a few things that you should know about…

## Tips and tricks for Using LAPS for Real

While the setup covered above is enough for most smaller environments it might be too insecure or not offer the audit level needed for larger organizations. Here are a few tips for making it work in the real world.

### 1\. Turn on Auditing

Auditing when someone reads or resets a password is important, especially considering that you can hook up alarms to it if someone reads the password of all computers. Luckily the AdmPwd module provides us with a cmdlet to enable just that.

```powershell
PS> Set-AdmPwdAuditing -AuditedPrincipals Everyone -OrgUnit "OU=Workstations,DC=contoso,DC=com"
```

### 2\. Ensure No User Can Directly Read the _ms-mcs-AdmPwd_ AD Attribute

One way is to ensure a user can’t read _ms-mcs-AdmPwd_ AD attribute is to create a self-service method get the local admin password of a computer. While out of scope for this article, check out tools like [JEA](https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/jea/overview?view=powershell-5.1) or [WebJEA](https://github.com/markdomansky/WebJEA) if you don’t have an existing self-service portal suitable for this.

### 3\. Reset the Ms-Mcs-AdmPwdTime Attribute During Disk Imaging

You must remember to reset the _Ms-Mcs-AdmPwdTime_ attribute when reimaging a LAPS-controlled computer otherwise it will not trigger the password change and will keep the local admin password given by the image. It will, however, trigger after the _Ms-Mcs-AdmPwdTime_ expires.

You can use the following PowerShell command to reset the `ExpirationTime` without the AdmPwd module:

```powershell
# With RSAT 
Get-ADComputer Workstation1 | Set-ADObject -Replace @{"ms-mcs-AdmPwdExpirationTime"=(Get-Date)} 

# Without RSAT
$Computer = New-Object DirectoryServices.DirectoryEntry "LDAP://CN=Workstation1,OU=Workstations,DC=contoso,DC=com"
$Computer.'ms-Mcs-AdmPwdExpirationTime'.Clear()
$Computer.CommitChanges()
```

### 4\. Remember the _ms-Mcs-AdmPwd_ Attribute Stays in the AD Recycle Bin

When you delete an object in AD and have the AD Recycle Bin enabled, AD usually removes important attributes; luckily ms-Mcs-AdmPwd is protected from that!

### 5\. LAPS is Not for Temporary Access

While tempting, LAPS is not meant to give temporary access to suppliers, users and other types of accounts. Instead of using LAPS, use an AD group that’s a local admin of that specific computer and use [TimeToLive on group memberships.](https://docs.microsoft.com/en-us/archive/blogs/askds/previewing-server-2016-tp4-temporary-group-memberships)

## Conclusion

You’ve now learned how to deploy LAPS, setting its permissions and some tips and tricks for making it more secure. With an environment where LAPS is deployed all the local administrator password changes regularly and automatically. This greatly reduces the risks of having a domain-joined computer taken over by hackers or malware and hopefully it saves you from a lot of headaches.

If you have any questions, please feel free to tweet me at @AlexAsplund or leave a comment below.

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fmicrosoft-laps%2F&text=Secure%20Windows%20Admin%20Passwords%20with%20Microsoft%20LAPS)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fmicrosoft-laps%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fmicrosoft-laps%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/2025/11/91e5abb1-5bca-4958-a9f1-0f203a8938f7.png)

### [How to Block Known Bad Active Directory Passwords](/block-passwords-active-directory/)

In this article, we will explore why and how to block the use of certain passwords for Active Directory user accounts. In an Active Directory environment,

![](https://adamtheautomator.com/wp-content/uploads/publisher/3ec5d9c85b2b81d9ab7cd5dbb6caf044/21b786d67f19d1813150edf9871e36ead78714b63880de8c6161c7fde11a9769.webp)

### [Pktmon: Capture Windows Traffic Without a Third-Party Driver](/pktmon-capture-windows-traffic/)

Use the in-box Windows Pktmon tool to capture packets and packet-drop reasons, then convert the ETL to pcapng and text for offline analysis.

![](https://adamtheautomator.com/wp-content/uploads/publisher/2e05d9c85b2b81feb24af1f04a889143/3eab14af9dabf46fbd333914ce6ccf46f84117d2394d3e7218c186cd249bb7e2.webp)

### [PowerShell or Power Automate: Stop Automation Mistakes](/powershell-vs-power-automate/)

Score six factors to choose between PowerShell and Power Automate: target system, complexity, data volume, team skills, cost, governance.

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)