Complete Guide to Local Administrator Password Solution LAPS

Professor Robert McMillen shows you how to setup LAPS on your servers and clients in a Windows environment to add additional security from your computers being compromised due to a weak or unchanging administrator password.
Import-module ADmPwd.PS
Update-AdmPwdADSchema
Set-AdmPwdComputerSelfPermission -orgunit “OU=Clients,DC=infosec,DC=int”
Set-admpwdreadpasswordpermission -orgunit “OU=Clients,DC=infosec,DC=int” -allowedprincipals ‘LAPS’
Set-admpwdResetpasswordpermission -orgunit “OU=Clients,DC=infosec,DC=int” -allowedprincipals ‘LAPS’

[@hermonkidane1503]

Exactly when I needed it. Thank you Robert. Appreciate everything you do.

[@techpub]

Thanks for watching and glad to hear it helped.

[@ValentinGheorghiu]

i have been using LAPS for years but i`m ashamed to say this is the first time i was even curious on how to set it up so thanks for adding something to my internal KB haha

[@techpub]

Glad it helped and thanks for watching.

[@andrewenglish3810]

Are you planning on doing an update to this video since MS has included LAPS for Windows Servers and Workstations (10 and 11) in their April 11 2023 update?

[@techpub]

Yes, and thanks for the reminder.

[@rmkvph]

What if client pc has multiple local administrator account?

[@techpub]

It will only use the first admin account. The others will not be saved unless you delete the first admin. Then it will use the second one.

[@WorldEnder]

Hello there, does it work on windows 8.1 clients? I still have a lot of win8 in my infrastructure

[@techpub]

It is just for servers only. Thanks for watching.

[@On-Way]

If the domain failed, can the LAPS account renewing the password ?

[@techpub]

You can log in locally with the last created local password, but without the domain, you'll need to reset it manually using the reset password video in the playlist.

[@TheBullz007]

Where did you use the sec group that was created. Pls explain

[@techpub]

I created it during the video so I could apply the PS commandlets to it.

[@SimoAtlas]

That was super helpful thank you

[@techpub]

Glad it helped and thanks for watching.

[@Akira29H]

What about domain password can laps capture

[@techpub]

No, it only does the local password as the domain pw is already in AD.

[@jhonjosephpagaduan826]

What is the username?

[@techpub]

Whatever your first user is on a client or the name administrator on a server.

[@amitTech76]

thanks

[@techpub]

You're welcome!