AD-SEC-001: Computers without LAPS¶

medium   Hardening   MITRE ATT&CK T1550.002   Reads: LDAP

Enabled Windows computers have no LAPS-managed local administrator password, so one shared local admin password can open many machines.

Also known as: laps

Why it matters¶

Without LAPS, the built-in local Administrator password is whatever the image or the person who installed the machine set, and it is usually the same on every computer built from that image. An attacker who gets SYSTEM on one workstation dumps the local SAM, takes the Administrator NT hash and uses it (pass-the-hash) on every other machine with the same password, collecting the credentials of whoever is logged on there until a server or helpdesk admin turns up.

LAPS gives every computer its own random local admin password, rotated on a schedule and stored in AD (or Entra ID) where only authorized admins can read it.

How ad-doctor detects it¶

From the LDAP snapshot: every enabled computer account that is not a domain controller and has neither of the LAPS expiry attributes set:

• ms-Mcs-AdmPwdExpirationTime (legacy Microsoft LAPS)
• msLAPS-PasswordExpirationTime (Windows LAPS)

The expiry time is written by the LAPS client each time it rotates the password, so an empty value means LAPS has never managed that computer. Computers whose operatingSystem does not contain "Windows" (NAS appliances, Linux joins) are skipped; computers with no operatingSystem value are kept, which includes cluster name objects.

The objects are sAMAccountNames, for example WS02$, FS01$.

Severity¶

Always medium, whatever the number of computers. The detail gives the count.

False positives and limits¶

• Windows LAPS backing up to Entra ID only writes to Entra ID, not to AD, so ad-doctor sees nothing. Accept those computers in an accepted-risk file if Entra ID is the intended store.
• The scanning account cannot read the expiry attributes. They are readable by authenticated users by default; if your schema extension removed that, every computer is reported. Run the scan with an account that can read them.
• Cluster name objects and failover cluster virtual names have no local administrator; accept them.
• Computers that were just joined report until the LAPS client first rotates the password.

Fix¶

1. List the computers and their LAPS state.

   Get-ADComputer -Filter 'Enabled -eq $true' `
       -Properties operatingSystem, 'msLAPS-PasswordExpirationTime', 'ms-Mcs-AdmPwdExpirationTime' |
       Where-Object { -not $_.'msLAPS-PasswordExpirationTime' -and -not $_.'ms-Mcs-AdmPwdExpirationTime' } |
       Select-Object Name, operatingSystem, DistinguishedName
   

2. Prepare the directory for Windows LAPS (once per forest, as Schema Admin), and let the computers in each OU write their own password:

   Update-LapsADSchema -WhatIf
   Set-LapsADComputerSelfPermission -Identity 'OU=Workstations,DC=corp,DC=example' -WhatIf
   

3. Grant read access only to the admins of each tier, not to helpdesk groups for tier-0 servers (see AD-SEC-002):

   Set-LapsADReadPasswordPermission -Identity 'OU=Workstations,DC=corp,DC=example' `
       -AllowedPrincipals 'CORP\Workstation Admins' -WhatIf
   

4. Turn on the policy with a GPO: Computer Configuration > Administrative Templates > System > LAPS > Configure password backup directory = Active Directory, and enable password encryption. Windows LAPS is built into supported Windows versions.

5. Rescan after the next policy refresh, and alert on local accounts used for network logons (event 4624, logon type 3, with a local account name) in the meantime.

Verify¶

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-SEC-001

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-SEC-001"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

Related checks¶

• AD-SEC-002

References¶

Microsoft and vendors

• Windows LAPS overview
• Get started with Windows LAPS and Windows Server Active Directory

Research

• Microsoft LAPS security and Active Directory LAPS configuration recon (Sean Metcalf)

MITRE ATT&CK

• T1550.002

Available since 0.1.0.