How to Manage macOS Local Administrator Passwords using Apple LAPS

The Challenge of Local Administrator Passwords

In enterprise macOS environments, IT departments typically provision a local administrator account (e.g., “ITAdmin”) on every Mac. This account is essential for remote troubleshooting and Helpdesk interventions. However, managing the password for this account is a massive security challenge. If all 5,000 Macs use the exact same local admin password, a single compromised machine gives an attacker lateral movement capabilities across the entire fleet.

In the Windows world, this is solved by Microsoft LAPS (Local Administrator Password Solution). For macOS, administrators can utilize an open-source solution inspired by the original, commonly referred to as macOS LAPS (often the Jamf LAPS integration or the open-source macOSLAPS project). This tool randomly generates a unique, cryptographically secure password for the local admin account on a regular schedule, and securely escrows that password into an MDM or Active Directory.

Prerequisites

To implement macOS LAPS, you need:

• A macOS fleet enrolled in an MDM (Mobile Device Management) solution, or joined to an Active Directory domain.
• A designated local administrator account on every Mac that needs to be managed.
• The macOS LAPS binary deployed to your fleet.

Step 1: Deploying the LAPS Binary

First, download the latest release of the macOSLAPS package from its official GitHub repository. Deploy this `.pkg` file to your macOS fleet using your MDM’s software distribution mechanism (e.g., Jamf Pro Policies, Kandji Custom Apps).

Step 2: Configuring the LAPS Behavior via MDM

macOS LAPS is configured entirely through a Managed Preference domain (com.github.jmagman.macOSLAPS). You must create a Custom Configuration Profile to define how the password behaves.

Create a `.mobileconfig` file with the following key-value pairs (or use a visual profile editor like iMazing Profile Editor):

• LocalAdminAccount: The exact username of the account you are managing (e.g., itadmin).
• DaysUntilExpiration: How frequently the password should rotate (e.g., 30).
• PasswordLength: The desired length of the generated password (e.g., 20).
• RemovePassKDEntries: Set to True to ensure the secure token is maintained correctly during password rotations.

Step 3: Escrowing the Password

The most critical part of LAPS is storing the generated password securely so IT can retrieve it when needed. macOS LAPS supports two primary methods:

1. Active Directory Escrow: If the Mac is bound to AD, the script can write the password directly to the ms-Mcs-AdmPwd attribute of the Mac’s computer object in Active Directory. This requires no extra configuration if the AD schema has been extended for Windows LAPS.
2. MDM Escrow: For cloud-managed Macs, the script can use an API token to send the password securely to an MDM extension attribute (e.g., a Jamf Pro Extension Attribute).

Configure the Method key in your Configuration Profile to specify either AD or API.

Step 4: Executing the Rotation

Once the Configuration Profile is deployed, you must trigger the binary to run. This is typically done by configuring a LaunchDaemon that executes /usr/local/bin/macOSLAPS every 12 hours.

When the binary runs, it checks if the current password has expired based on the DaysUntilExpiration setting. If it has, it generates a new 20-character string, updates the local account using the dscl utility, and immediately transmits the new password to your chosen escrow destination.

Conclusion

Implementing a Local Administrator Password Solution is a fundamental requirement for modern security compliance frameworks (like SOC 2 and ISO 27001). By deploying macOS LAPS, you eliminate the risk of shared passwords and significantly harden your enterprise Apple environment against lateral attacks.