Local Administrator Password Solution (LAPS)
Description
Automated management of local administrator account passwords on Windows domain-joined endpoints, ensuring each machine has a unique, cryptographically random password that rotates on a defined schedule. Legacy LAPS (AdmPwd.E) stores passwords as a confidential attribute on the computer object in AD, protected by ACLs. Windows LAPS (built-in to Windows 10 21H2+ and Server 2019+) adds password encryption using the machine's AD certificate and supports Azure AD-joined devices. LAPS eliminates the most common Windows lateral movement vector: shared local admin passwords set during imaging and never rotated. Without LAPS, compromising one machine's local admin hash (via SAM dump, Mimikatz, or volume shadow copy) enables Pass-the-Hash to every endpoint sharing that password. With LAPS, each hash works on exactly one machine and expires on the rotation schedule. Does not protect domain credentials, service accounts, or application-level credentials — only the local administrator account managed by the LAPS policy.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Confidentiality (C) | H → L | Without LAPS, compromising one machine's local admin hash (SAM dump, Mimikatz) yields credentials valid on every machine sharing that password — confidentiality impact spans the entire fleet. With LAPS, each machine has a unique random password, so a stolen hash provides admin access only to the single compromised endpoint. Impact is reduced from fleet-wide credential exposure to single-machine access |
| Scope (S) | C → U | In environments with shared local admin passwords, any local admin compromise effectively changes scope to other machines via Pass-the-Hash — the vulnerability impacts resources beyond the vulnerable component. With LAPS, the compromised credential works only on the originating machine, containing the blast radius to the vulnerable component's security authority. Does not prevent lateral movement via domain credentials, shared service accounts, or non-credential scope changes (VM escape, container escape) |
CWE Relationships
Verification
Verify LAPS policy enforcement via registry (legacy or Windows LAPS) and confirm managed password exists in AD
# Expected: 1
# Expected: >=1
# Expected: 4
# Expected: YES
Remediation
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd' -Force | Out-Null; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd' -Name AdmPwdEnabled -Value 1 -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd' -Name PasswordComplexity -Value 4 -Type DWord; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd' -Name PasswordLength -Value 20 -Type DWord; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd' -Name PasswordAgeDays -Value 30 -Type DWord
Reset-LapsPassword -ErrorAction SilentlyContinue; gpupdate /forceApplicability (CVE 5.2.0 Schema)
| Vendor | Product | CPEs | Platforms | Status |
|---|---|---|---|---|
| microsoft | windows |
cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_11:*:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*
|
All | applicable |