Local administrator passwords: LAPS
You learn why the same local administrator password on every computer is dangerous, look at the LAPS schema and the confidential attribute, find which computers are managed by LAPS, which are left out, whose password has expired and who can read the passwords, and record your findings. The missing computers and the readers differ in every lab.
Level 201 · 45 min
Every Windows computer has a local administrator account. When organisations install computers from the same image, this account’s password is often the same on every machine. If an attacker takes that password (or its hash) on one computer, the same key opens every computer: this is called lateral movement.
LAPS (Local Administrator Password Solution) fixes this: every computer generates its own random local administrator password, changes it at intervals and writes it to its own computer object in AD. Only an authorised group can read the password.
In this lesson you audit LAPS’ coverage: a machine left out, an expired password and too-broad read access are the three most common findings.
What you will do in this lesson
- Is the LAPS schema installed?
- Computers managed by LAPS
- Can the auditor read the password?
- The ones left out of LAPS
- An expired password
- Who can read the passwords?
- The out-of-scope list
- The expired ones
- Too-broad read access
- Short quiz
Skills you will earn
- Recognising the LAPS schema and the confidential attribute
- Finding computers managed and not managed by LAPS
- Verifying a confidential attribute is hidden from the auditor
- Converting Windows FILETIME values to dates
- Finding expired LAPS passwords
- Auditing who can read LAPS passwords
- Writing audit findings into a report
← Password policy and fine-grained password policies (FGPP) · Active Directory security: auditing and hardening · Auditing SMB shares and their permissions →
Start for free