How to Configure Local Administrator Password Solution Using PowerShell

Shared local administrator passwords across Windows workstations represent a critical vulnerability that attackers exploit to move laterally across enterprise networks. If a single endpoint is compromised, attackers use tools like Mimikatz to dump the local password hash and gain administrative access to every other workstation sharing that identical credential. Windows Local Administrator Password Solution (Windows LAPS)—now natively integrated into Windows 11 and Windows Server 2022—automatically rotates, randomizes, and encrypts unique local administrator passwords for every machine.

Native Windows LAPS vs. Legacy LAPS

Native Windows LAPS introduces significant security enhancements over the legacy download:

• Built Directly into Windows: No separate MSI client installation is required; native LAPS is built into Windows 11 and updated via standard cumulative updates.
• Azure AD (Entra ID) and On-Premises Active Directory Support: Natively escrows passwords directly into Microsoft Entra ID or on-premises Active Directory.
• Password Encryption: In on-premises Active Directory, passwords are cryptographically encrypted using Kerberos-based encryption, ensuring only designated security groups can read plaintext secrets.
• Automatic Post-Logon Authentication Reset: Automatically triggers immediate password rotation after a local administrator logs out or disconnects an elevation session.

Configuring Active Directory Schema for Windows LAPS

Before managing native LAPS in on-premises environments, prepare your Active Directory domain:

1. Open PowerShell (Admin) on a domain controller running the Active Directory module.
2. Update the Active Directory schema to support native LAPS attributes:

   Update-LapsADSchema

3. Grant specific administrative security groups permission to read encrypted passwords:

   Set-LapsADReadPasswordPermission -Identity "OU=Workstations,DC=domain,DC=com" -AllowedPrincipals "Workstation Admins"

Configuring LAPS Policies on Windows 11 via PowerShell

Administrators can configure LAPS settings directly via the registry or local group policy:

# Define the registry configuration path:
$LapsPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS"
If (!(Test-Path $LapsPath)) { New-Item -Path $LapsPath -Force }

# Configure backup destination (1 = Active Directory, 2 = Azure AD):
Set-ItemProperty -Path $LapsPath -Name "BackupDirectory" -Value 1 -Type DWord

# Specify the target local administrator account name:
Set-ItemProperty -Path $LapsPath -Name "AdministratorAccountName" -Value "LocalAdmin" -Type String

# Enforce password complexity (4 = Large, small, numbers, symbols):
Set-ItemProperty -Path $LapsPath -Name "PasswordComplexity" -Value 4 -Type DWord

# Set password length (e.g., 20 characters):
Set-ItemProperty -Path $LapsPath -Name "PasswordLength" -Value 20 -Type DWord

# Set password expiration age (in days, e.g., 30):
Set-ItemProperty -Path $LapsPath -Name "PasswordAgeDays" -Value 30 -Type DWord

# Enable post-authentication reset action (1 = Reset password and sign out):
Set-ItemProperty -Path $LapsPath -Name "PostAuthenticationActions" -Value 1 -Type DWord
Set-ItemProperty -Path $LapsPath -Name "PostAuthenticationResetDelay" -Value 12 -Type DWord

Retrieving and Rotating Passwords via PowerShell

Authorized administrators can retrieve current passwords and trigger on-demand rotations:

# Retrieve the current encrypted password from Active Directory:
Get-LapsADPassword -Identity "WKS-DEV-01"

# Force immediate password rotation on a target computer:
Reset-LapsPassword -Identity "WKS-DEV-01"

Auditing LAPS Operations in Event Viewer

To verify that LAPS is actively rotating credentials without errors:

1. Press Win + X and open Event Viewer.
2. Navigate to: Applications and Services Logs > Microsoft > Windows > LAPS > Operational.
3. Look for Event ID 10017 (LAPS successfully encrypted and stored the new password) and Event ID 10020 (Post-authentication reset scheduled).

Configuring native Windows LAPS with PowerShell eliminates credential reuse across endpoints, establishing zero-trust hygiene across modern enterprise fleets.