Comments on: Step by Step guide to Installing Microsoft LAPS

By: jacobad

jacobad — Mon, 29 Apr 2024 15:14:37 +0000

Please i have configured the laps and is working. but i saw that users who are not part of the group to view the password are able to view,. What can be the cause.

By: Liv

Liv — Mon, 14 Oct 2019 04:46:20 +0000

Hello,
Can seperate to audit “get-admpwdpassword” and “Reset-admpwdpassword”? as in my testing, after enable audit LAPS, get and reset events both record in event 4662, but could identify which one is get password and which one is reeset password.

By: Liv

Liv — Fri, 11 Oct 2019 09:47:20 +0000

Hello, Can LAPS manage for cross domain? if can, how to configure that?

By: Pixel Robots.

Pixel Robots. — Tue, 02 Apr 2019 11:02:33 +0000

In reply to Ryan.

Hello, Have a look at https://social.technet.microsoft.com/Forums/en-US/c5cc1fed-da22-4b49-91f4-800e18684583/audit-log-laps?forum=winserverDS to learn more about auditing.

By: Ryan

Ryan — Tue, 02 Apr 2019 04:57:17 +0000

Hi ,

If I add a group “Help desk” to have permission to view LAPS password.

may i know is any log recorded which members get the local admin password in “help desk” group?

By: Pixel Robots.

Pixel Robots. — Mon, 04 Mar 2019 11:11:18 +0000

In reply to Ryan.

Hello,

LAPS uses the SID of the account and not the name, so you are fine to change it to whatever you like.

Thanks

Richard

By: Ryan

Ryan — Mon, 04 Mar 2019 02:20:31 +0000

HI,

May i know is Microsoft LAPS still function if I change the workstation default administrator account to another name (eg: WSadmin)?

Thanks

By: Pixel Robots.

Pixel Robots. — Wed, 09 Jan 2019 09:12:36 +0000

In reply to Deivasigamani Duraisamy.

I have not tested using an LDAP query, but as you set permissions on who can see the password anyone doing an LDAP query who does not have permission will not be able to see the password. I have opened Active Directory Users and computers with an account that does not have access to the password and it shows .

Hope that helps.

Richard

By: Deivasigamani Duraisamy

Deivasigamani Duraisamy — Wed, 09 Jan 2019 09:05:32 +0000

If the password is listed in AD, then anyone can easily read it with the help of LDAP queries. Am I correct?

By: Pixel Robots.

Pixel Robots. — Mon, 03 Dec 2018 13:13:27 +0000

In reply to Fadi Hamdan. Are you accessing the gpo MMC on the same server you installed LAPS on? Also, if you are using a central store for group policy. Copy the admx files to it too. Then you will be able to use and gpo MMC to edit the files.