# LAPS should be installed in Active Directory

The Local Administrator Password Solution (LAPS) is a critical security tool that:

Source: https://maester.dev/docs/tests/AD-SCH-05

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Schema · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-SCH-05
```

## Overview

The Local Administrator Password Solution (LAPS) is a critical security tool that:

- **Manages local admin passwords**: Automatically rotates passwords on domain-joined computers
- **Prevents lateral movement**: Eliminates shared local administrator passwords
- **Secure storage**: Stores passwords securely in Active Directory attributes
- **Access control**: Controls who can retrieve local administrator passwords
- **Audit trail**: Logs password access for compliance

Without LAPS, organizations commonly face these risks:
- **Pass-the-hash attacks**: Attackers use shared local credentials to move laterally
- **Persistent access**: Compromised local accounts provide ongoing access
- **Credential stuffing**: Shared passwords reused across multiple systems
- **Compliance failures**: Many frameworks require unique local admin passwords

#### Control Type

**Preventive**

#### Security Recommendation

Deploy LAPS across your entire domain:

1. **Install LAPS**: Download from Microsoft and extend the AD schema
2. **Group Policy**: Configure password rotation policies (recommended: every 30 days)
3. **Access controls**: Limit who can read the ms-Mcs-AdmPwd attribute
4. **Monitoring**: Alert on password retrieval events
5. **Legacy LAPS**: Consider upgrading to Windows LAPS (built into Windows 11/Server 2022)

#### How the Test Works

This test checks for the presence of LAPS schema attributes (ms-Mcs-AdmPwd) to determine if LAPS has been installed and configured in the Active Directory environment.

#### Related Tests

- `Test-MtAdComputerUnconstrainedDelegationCount` - Check for delegation risks
- `Test-MtAdUserPasswordNeverExpiresCount` - Identify password policy gaps
- `Test-MtAdPasswordComplexityRequired` - Verify password policies

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-SCH-05 |
| Severity | Medium |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Schema |
| Area | Privileged access |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.003 Local Accounts, T1550.002 Pass the Hash |
| Supports controls | nist-800-53-r5:IA-5, nist-800-53-r5:AC-6(2) |
| PowerShell test | [Test-MtAdLapsInstalledStatus](https://github.com/maester365/maester/blob/main/tests/ad/schema/Test.AD-SCH-05.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:Schema/*:ReadProperty |

</details>

## Source

- Test: [`tests/ad/schema/Test.AD-SCH-05.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/schema/Test.AD-SCH-05.ps1)
- Documentation: [`tests/ad/schema/Test.AD-SCH-05.md`](https://github.com/maester365/maester/blob/main/tests/ad/schema/Test.AD-SCH-05.md)