Lesson 4.16: LAPS: a different local admin password on every machine
Every Windows computer has a local Administrator account. If they all share one password, set years ago in an image or a Group Policy, an attacker who takes one machine can log on to all of them. Windows LAPS gives each computer its own random password, rotates it, and stores it in the directory where only chosen groups can read it. In the lab you find the computers without LAPS, see in the logs how the attacker reused a shared local password on exactly those machines (and failed on the others), check who may read LAPS passwords, and extend the policy to the servers.
17 min
You will learn to
- Explain why shared local admin passwords are dangerous
- Find computers without LAPS
- Spot local-account lateral movement in logs
- Review who can read LAPS passwords
- Link a GPO to an OU with ldapmodify
Key terms
- Local Administrator
- The built-in admin account (RID 500) on each Windows computer, separate from domain accounts.
- Windows LAPS
- Local Administrator Password Solution: a random, rotated password per computer, stored in AD (or Entra ID).
- Lateral movement
- Moving from one compromised machine to others.
- gPLink
- Attribute of a domain or OU listing the GPOs linked to it, in order.
- Pass-the-hash
- Logging on over NTLM with a password hash instead of the password.
← Capstone: a security release gate · All lessons · DNS and beaconing →