How to Configure Microsoft Local Administrator Password Solution (LAPS) via Group Policy

Introduction

Reusing the same local Administrator password across all computers in an Active Directory (AD) environment is a massive security vulnerability. If one machine is compromised, the attacker can use Pass-the-Hash techniques to move laterally across the entire network. Microsoft’s Local Administrator Password Solution (LAPS) solves this by automatically managing and randomizing the local administrator password for every domain-joined computer, storing the secrets securely in AD. This guide explains how to deploy LAPS using Group Policy.

Prerequisites

To deploy LAPS, you require Domain Administrator privileges. You must also download the LAPS installer (LAPS.msi) from the Microsoft Download Center.

Step 1: Extend the Active Directory Schema

LAPS requires two new attributes in AD to store the password and expiration time. Install the LAPS management tools on your Domain Controller or management workstation. Open an elevated PowerShell prompt and run:

Import-Module AdmPwd.PS
Update-AdmPwdADSchema

Ensure this returns a success status. This step is irreversible but completely safe for existing environments.

Step 2: Grant Computer Accounts Permission to Update Passwords

The computer accounts need permission to write their new randomly generated passwords into their own AD object attributes. Run the following command, specifying the Organizational Unit (OU) where your workstations are located:

Set-AdmPwdComputerSelfPermission -OrgUnit "OU=Workstations,DC=yourdomain,DC=com"

Step 3: Restrict Password Read Access

By default, Domain Admins can read the LAPS passwords, but you might want to restrict this further or grant it to a specific Helpdesk group. To grant read access to a specific group (e.g., “HelpdeskAdmins”):

Set-AdmPwdReadPasswordPermission -OrgUnit "OU=Workstations,DC=yourdomain,DC=com" -AllowedPrincipals "HelpdeskAdmins"

Step 4: Install the LAPS Client Extension

The LAPS Group Policy Client Extension (CSE) must be installed on every machine you want to manage. You can deploy this via Software Installation in Group Policy, Microsoft Endpoint Configuration Manager (SCCM), or a simple startup script running:

msiexec /i \\Server\Share\LAPS.msi /quiet

Step 5: Configure the LAPS Group Policy Object (GPO)

Now, enable LAPS enforcement:

1. Open the Group Policy Management Console (GPMC) and create a new GPO named “Enforce LAPS”. Link it to your Workstations OU.
2. Edit the GPO and navigate to Computer Configuration > Policies > Administrative Templates > LAPS.
3. Enable the Enable local admin password management policy.
4. Configure the Password Settings policy to define complexity, length, and age (e.g., 14 characters, expiring every 30 days).

Once clients pull this GPO and the CSE is installed, they will immediately randomize their local administrator password and push it to Active Directory. You can retrieve the passwords using the LAPS UI tool or the Get-AdmPwdPassword PowerShell cmdlet.