What Does LAPS Mean?

Imagine you are the manager of a large apartment building with hundreds of units. Each unit has its own front door lock. If you gave every tenant the same key to the building’s maintenance closet, then any tenant who lost their key would put the entire building at risk. Worse, an outsider who found one key could access every apartment’s maintenance area. That is exactly what happens when every Windows computer on a corporate network has the same local administrator password.

LAPS fixes this by giving every computer its own unique, very strong password for the local admin account. These passwords are stored in a central directory called Active Directory, which is like a secure vault. Only IT administrators who have been given permission can open that vault and look up a specific computer’s password. If a password is ever compromised, LAPS can automatically change it to something new, making the old password useless.

In plain terms, LAPS makes sure that even if an attacker steals a password from one computer, they cannot use that same password to log into any other computer on the network. This is a huge boost to security because it stops the kind of attack where a hacker moves from machine to machine, looking for more valuable data. LAPS also helps IT teams comply with security policies that require strong, rotated passwords for local accounts, without requiring them to visit each computer physically.

LAPS, or Local Administrator Password Solution, is a Microsoft-provided security tool that manages the passwords of local administrator accounts on domain-joined Windows computers and servers. It is not a built-in feature of Windows but is deployed as an optional component via the LAPS MSI package, which includes a Group Policy client-side extension and an Active Directory schema extension.

The core mechanism works by using Group Policy to instruct each targeted computer to generate a new, cryptographically random password for its local administrator account at a configurable interval. The computer then writes that password to a specific attribute on its corresponding computer object in Active Directory. These attributes, ms-Mcs-AdmPwd and ms-Mcs-AdmPwdExpirationTime, are added to the AD schema during LAPS deployment. The password is stored in clear text within the directory, but access to it is secured through standard Active Directory access control lists (ACLs).

For security, LAPS does not rely on the computer’s own security principal to write the password; instead, the computer uses its own machine account credentials to write to its object. Administrators who need to retrieve a password must have delegated read permission on the ms-Mcs-AdmPwd attribute of the relevant computer objects. By default, only Domain Admins and the computer itself have this read access. The solution supports both 24-character and 128-character password lengths, with complexity that includes lowercase letters, uppercase letters, numbers, and special characters.

LAPS operates without any additional infrastructure beyond Active Directory and the client-side extension. It does not require a dedicated server, database, or licensing beyond standard Windows Server and Windows client licenses. The solution is fully compatible with on-premises Active Directory environments and can be managed via PowerShell using the LAPS module cmdlets such as Get-LapsADPassword, Set-LapsADComputerSelfPermission, and Update-LapsADSchema. Microsoft has released a newer, modern version of LAPS in Windows 10 20H2 and later called Windows LAPS, which integrates more deeply with Azure Active Directory and offers encryption of the stored password.

In real IT implementations, LAPS is deployed as part of a baseline security configuration. Administrators extend the AD schema, delegate the appropriate permissions to helpdesk groups, and then create a Group Policy Object (GPO) that configures the LAPS client-side extension. This GPO defines password complexity, length, and expiration period. Once applied, the LAPS client runs during Group Policy refresh, typically every 90 minutes, and checks if a password change is due. If so, it generates a new password and updates the AD attribute.

In any organization with more than a handful of Windows computers, the local administrator account is a prime target for attackers. Without a tool like LAPS, IT administrators often set the same static password on every machine for convenience. This creates a massive security vulnerability: if an attacker compromises one machine and extracts that password, they can move laterally across the entire network, potentially reaching domain controllers and sensitive data.

LAPS eliminates this risk by ensuring that every computer has a unique, complex, and regularly rotated local admin password. This practice is a fundamental part of a defense-in-depth strategy and aligns with well-known security frameworks such as the Center for Internet Security (CIS) controls and the Microsoft Security Compliance Toolkit. It also supports compliance requirements for regulations like PCI DSS, HIPAA, and GDPR, which mandate strict access control and credential management.

For IT professionals, LAPS reduces operational overhead. Instead of manually resetting passwords after an incident or when an employee leaves, the solution automates password rotation. It also provides a clear audit trail because password retrieval is logged in Active Directory. Helpdesk teams can look up a local admin password when needed for remote troubleshooting, without having to store passwords in spreadsheets or on sticky notes.

The solution is also important for managing privileged access. By restricting who can read LAPS passwords, organizations can enforce the principle of least privilege. Even if a junior administrator has local admin rights on their own machine, they cannot access the local admin password for the CEO’s laptop unless explicitly authorized. This granular control is essential for preventing insider threats and accidental misuse.

Exam questions about LAPS typically fall into three categories: scenario-based, configuration, and troubleshooting. In scenario-based questions, you are given a description of a company that has many Windows computers all using the same local admin password. After a breach, attackers moved from machine to machine. The question asks: 'Which solution should be deployed to prevent this in the future?' The obvious answer is LAPS.

Configuration questions may ask about the necessary prerequisites for deploying LAPS. For example: 'What must be performed before deploying LAPS?' The correct answer includes extending the Active Directory schema and installing the LAPS client-side extension on target computers. Another variant might ask: 'Which attribute stores the LAPS password?' The answer is ms-Mcs-AdmPwd.

Troubleshooting questions often revolve around why LAPS is not working. For instance: 'A support technician deployed LAPS but passwords are not being updated on client computers. What is the most likely cause?' Possible reasons include the LAPS client extension not being installed, the Group Policy not being applied (check gpresult), or the computer object in Active Directory lacking the necessary permissions to write the password attribute. You might also see a question where an administrator cannot read the LAPS password of a specific computer. The cause is likely that the administrator’s user account does not have delegated read access to the ms-Mcs-AdmPwd attribute.

Another common question pattern involves Windows LAPS versus the classic LAPS. For example: 'An organization wants to manage local admin passwords for Azure AD-joined devices. Which solution should they use?' The answer is Windows LAPS, which integrates with Azure AD, rather than the classic LAPS that only works with on-premises Active Directory.

Pay attention to questions that ask about password rotation intervals. LAPS can be configured to change passwords after a set number of days, and a question may present a scenario requiring a specific rotation policy (e.g., every 30 days). The answer will involve configuring the relevant Group Policy settings, such as 'Password age (days)' in the LAPS administrative template.

LAPS is one of the simplest yet most impactful security tools a Windows administrator can deploy. In practice, many organizations underestimate how quickly a shared local admin password can be extracted and abused. The first step in any LAPS deployment is to assess your environment’s readiness. Ensure your domain controllers are running a supported version of Windows Server (2008 R2 or later) and that your clients are at least Windows 7 SP1 or Windows Server 2008 R2. For modern environments, Windows LAPS is preferred because it supports both on-prem AD and Azure AD, plus it offers encrypted storage of passwords in AD.

When configuring LAPS, the most critical decision is the password age. A shorter age increases security but also increases network traffic and writes to AD. A common best practice is 30 days, but organizations handling highly sensitive data may set it to 7 days. Password length is also important: while 14 characters is often considered secure, many organizations use 24 or even 128 characters to be safe. Keep in mind that longer passwords may cause issues with some older applications or scripts that hard-code a maximum length.

A common pitfall in real implementations is forgetting to delegate the computer’s self-write permission. Without this, the LAPS client will fail to write the password to AD, and the password will remain unchanged. Check the event log on the client (Event ID 10030 from LAPS) to diagnose this. Also, ensure that the LAPS service is running and that the Group Policy settings are being applied. Use gpresult /h to verify the applied GPOs.

For retrieval, IT professionals should rely on the LAPS PowerShell module rather than the legacy UI tool, as it enables scripting and integration with helpdesk ticketing systems. A typical retrieval command is: Get-LapsADPassword -Identity 'Workstation123' -AsPlainText. The output will display the current local admin password. Ensure that the account running this command has the necessary read permission. If an administrator cannot retrieve the password, the most common cause is missing delegation permissions.

What can go wrong? Besides permission issues, the LAPS client can conflict with third-party security software that blocks the modification of local accounts. If a password reset fails repeatedly, check for such conflicts. Also, if the computer object is moved to a different OU after LAPS is configured, the GPO may no longer apply, and the password will not be rotated. Always audit your OUs and GPO linkage when restructuring your directory.