LAPS should be installed in Active Directory

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Schema · All checks

Run this check

Invoke-Maester -TestId AD-SCH-05

Overview

The Local Administrator Password Solution (LAPS) is a critical security tool that:

• Manages local admin passwords: Automatically rotates passwords on domain-joined computers
• Prevents lateral movement: Eliminates shared local administrator passwords
• Secure storage: Stores passwords securely in Active Directory attributes
• Access control: Controls who can retrieve local administrator passwords
• Audit trail: Logs password access for compliance

Without LAPS, organizations commonly face these risks:

• Pass-the-hash attacks: Attackers use shared local credentials to move laterally
• Persistent access: Compromised local accounts provide ongoing access
• Credential stuffing: Shared passwords reused across multiple systems
• Compliance failures: Many frameworks require unique local admin passwords

Control Type

Preventive

Security Recommendation

Deploy LAPS across your entire domain:

1. Install LAPS: Download from Microsoft and extend the AD schema
2. Group Policy: Configure password rotation policies (recommended: every 30 days)
3. Access controls: Limit who can read the ms-Mcs-AdmPwd attribute
4. Monitoring: Alert on password retrieval events
5. Legacy LAPS: Consider upgrading to Windows LAPS (built into Windows 11/Server 2022)

How the Test Works

This test checks for the presence of LAPS schema attributes (ms-Mcs-AdmPwd) to determine if LAPS has been installed and configured in the Active Directory environment.

Related Tests

• Test-MtAdComputerUnconstrainedDelegationCount - Check for delegation risks
• Test-MtAdUserPasswordNeverExpiresCount - Identify password policy gaps
• Test-MtAdPasswordComplexityRequired - Verify password policies

Details

Every attribute of this check

Field	Value
Test ID	AD-SCH-05
Severity	Medium
Suite	Active Directory
Product	Active Directory
Feature	Schema
Area	Privileged access
Resource type	Tenant
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1078.003 Local Accounts, T1550.002 Pass the Hash
Supports controls	nist-800-53-r5:IA-5, nist-800-53-r5:AC-6(2)
PowerShell test	Test-MtAdLapsInstalledStatus
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:Schema/*:ReadProperty

Source

• Test: tests/ad/schema/Test.AD-SCH-05.ps1
• Documentation: tests/ad/schema/Test.AD-SCH-05.md