Legacy Update: Get back online, activate, and install updates on your legacy Windows PC

The "Local Administrator Password Solution" (LAPS) provides management of local account passwords of domain joined computers. Passwords are stored in Active Directory (AD) and protected by ACL, so only eligible users can read it or request its reset.

• 
  For environments in which users are required to log on to computers without domain credentials, password management can become a complex issue. Such environments greatly increase the risk of a Pass-the-Hash (PtH) credential replay attack. The Local Administrator Password Solution (LAPS) provides a solution to this issue of using a common local account with an identical password on every computer in a domain. LAPS resolves this issue by setting a different, random password for the common local administrator account on every computer in the domain. Domain administrators using the solution can determine which users, such as helpdesk administrators, are authorized to read passwords.
  
  LAPS simplifies password management while helping customers implement recommended defenses against cyberattacks. In particular, the solution mitigates the risk of lateral escalation that results when customers use the same administrative local account and password combination on their computers. LAPS stores the password for each computer’s local administrator account in Active Directory, secured in a confidential attribute in the computer’s corresponding Active Directory object. The computer is allowed to update its own password data in Active Directory, and domain administrators can grant read access to authorized users or groups, such as workstation helpdesk administrators.
  
  Use LAPS to automatically manage local administrator passwords on domain joined computers so that passwords are unique on each managed computer, randomly generated, and securely stored in Active Directory infrastructure. The solution is built on Active Directory infrastructure and does not require other supporting technologies. LAPS uses a Group Policy client-side extension (CSE) that you install on managed computers to perform all management tasks. The solution’s management tools provide easy configuration and administration.
  
  
  How does LAPS work?
  The core of the LAPS solution is a GPO client-side extension (CSE) that performs the following tasks and can enforce the following actions during a GPO update:
  • Checks whether the password of the local Administrator account has expired.
  • Generates a new password when the old password is either expired or is required to be changed prior to expiration.
  • Validates the new password against the password policy.
  • Reports the password to Active Directory, storing it with a confidential attribute with the computer account in Active Directory.
  • Reports the next expiration time for the password to Active Directory, storing it with an attribute with the computer account in Active Directory.
  • Changes the password of the Administrator account.
  The password then can be read from Active Directory by users who are allowed to do so. Eligible users can request a password change for a computer.
  
  What are the features of LAPS?
  LAPS includes the following features:
  • Security that provides the ability to:
    • Randomly generate passwords that are automatically changed on managed machines.
    • Effectively mitigate PtH attacks that rely on identical local account passwords.
    • Enforced password protection during transport via encryption using the Kerberos version 5 protocol.
    • Use access control lists (ACLs) to protect passwords in Active Directory and easily implement a detailed security model.
  • Manageability that provides the ability to:
    • Configure password parameters, including age, complexity, and length.
    • Force password reset on a per-machine basis.
    • Use a security model that is integrated with ACLs in Active Directory.
    • Use any Active Directory management tool of choice; custom tools, such as Windows PowerShell, are provided.
    • Protect against computer account deletion.
    • Easily implement the solution with a minimal footprint.
  

Files

Status: Live This download is still available on microsoft.com. The downloads below will come directly from the Microsoft Download Center.

File	Size
LAPS.ARM64.msi SHA1: 5da7d260a9e927af37112bc2c1dc00135f8b64d3	529 KB
LAPS.x64.msi SHA1: 668a372744d2f70158b843f121052af6a83fbe6f	502 KB
LAPS.x86.msi SHA1: 5508602ce8c59ea18a8181923924c0c806756b57	491 KB
LAPS_Datasheet.docx SHA1: 8a375c330e6c7a3a2f7ac5bfe55a903c4176c51b	91 KB
LAPS_OperationsGuide.docx SHA1: 8793f168e443512c0dcacd3c4873295364d6468f	593 KB
LAPS_TechnicalSpecification.docx SHA1: 53f1005cf41f03bd67766c0dec6367df42988fa2	65 KB

File sizes and hashes are retrieved from the Wayback Machine’s indexes. They may not match the latest versions of files hosted on Microsoft servers.

• 
  Active Directory: (requires AD schema extension)
    • Windows 2003 SP1 or later.
  Managed machines:
    • Windows Server 2003 SP2 or later, or Windows Server 2003 x64 Edition SP2 or later.
       Note: Itanium-based machines are not supported.
  Management tools:
    • .NET Framework 4.0
    • PowerShell 2.0 or later
  

• The following steps need to be performed to configure LAPS
  
  • Installation of GP CSE (Group Policy Client Side Extension) via MSI installation
    • On management computers
    • On clients to be managed
  • AD preparation
    • schema extension
    • Permission updates
  • Group policy configuration
  
  Further details can be found in the operations guide.