Ensure LAPS AdmPwd GPO Extension / CSE is installed

What is Local Administrator Password Solution

The Windows Local Administrator Password Solution (Windows LAPS) is a built-in Windows feature designed to seamlessly handle and safeguard the password for a local administrator account on devices joined to either Microsoft Enterprise or Windows Server Active Directory domains. Additionally, Windows LAPS can be utilized to automatically manage and secure the Directory Services Restore Mode (DSRM) account password on Windows Server Active Directory domain controllers. Authorized administrators have the capability to retrieve and employ the DSRM password as needed.

Windows Password Guidelines: Updated Best Practices for 2024

Implementing LAPS

Implementing the LAPS tool requires:

1. An update in the Active Directory Schema
2. The installation of Group Policy Client Side Extension (CSE) on target endpoints (By choosing AdmPwd GPO Extension while installation)
3. Creating a GPO to configure LAPS
4. Installing the administrative template files (admx files)
5. Configuring the settings by admx files according to requirements
6. Applying the GPO to the desired Organizational Unit (OU)

Only local administrator account passwords can be managed by LAPS so it must not be used directly on the Domain Controllers because DC's do not have a customary local administrator account. So, it is highly recommended that LAPS CSE and LAPS GPO should only be deployed on the member endpoints.

LAPS vulnerability

LAPS has some security gaps that need to be eliminated such as:

1. Strong authentication and authorization are not supported by LAPS
2. Administrator accounts are always vulnerable to attacks because LAPS do not provide jit (just-in-time) access
3. Attackers can use stolen passwords as there is no force password reset
4. All the users must know their account passwords which implicate security issues
5. If Active Directory is not available in a disaster recovery scenario the passwords for local Administrator accounts cannot be retrieved and local password reset is required using tools such as DaRT (Disaster and Recovery Toolset)

Configuring LAPS AdmPwd GPO Extension / CSE is installed

For Windows environments, security setting LAPS AdmPwd GPO Extension / CSE is used to strengthen security by managing local admin passwords securely.

Recommended configuring for Microsoft Local Administrator Password Solution security setting: "Ensure LAPS AdmPwd GPO Extension / CSE is installed" is due to the challenges associated with managing local Administrator passwords. Numerous organizations opt to employ identical passwords across all workstations and/or Member Servers during deployment. However, this practice poses a significant security risk as it expands the attack surface. If an attacker successfully compromises one system and obtains the password for its local Administrator account, they can exploit this access to immediately infiltrate all other computers that share the same password for their local Administrator account.

There is no impact when AdmPwd.dll is installed and registered correctly. It remains inactive unless it receives specific GPO commands during Group Policy refresh. Unlike a memory-resident agent or service, it does not actively run in the background.

In a disaster recovery situation where Active Directory is unavailable, retrieving the local Administrator password is not feasible. In such cases, resorting to a local password reset tool like Microsoft’s Disaster and Recovery Toolset (DaRT) Recovery Image may be required.

By automating this process, organizations can ensure that the LAPS AdmPwd GPO Extension or CSE is consistently deployed across all relevant systems, enabling the centralized management and periodic rotation of local administrator passwords. The automated configuration hardening approach enhances security by reducing the risk of password exposure and mitigating the potential for unauthorized access or lateral movement within the network.

Windows Update Result in Memory Leak and Domain Controllers Crashing

LAPS Security Recommendations

Some security recommendations must be followed while using LAPS:

1. LAPS policies must be assigned to users via Item-Level Targeting
2. Organization must deny the ability to retrieve a password for the LAPS Readers Group
3. While configuring LAPS, set "Do Not Allow Longer Expiration" to enabled
4. While configuring LAPS, configure the password length and strength strong
5. "All Extended Rights" permission must be removed for users and groups that are not allowed to retrieve passwords

Policy Path:

If LAPS is installed then you will be able to see the "AdmPwd.dll" file in the following path:

C:\Program Files\LAPS\CSE\AdmPwd.dll

Registry Settings:

If the following registry value is present then LAPS GPO/CSE extension is installed:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D087DE603E3EA}:DllName

Default Value:

By default, LAPS is not installed