CME-808
Local Administrator Password Solution (LAPS)
Description
Automated rotation of local administrator account passwords on Windows endpoints. LAPS generates unique, randomly-generated passwords per machine and stores them in Active Directory with ACL-protected access. Prevents lateral movement attacks that rely on shared or default local admin credentials by ensuring each machine has a cryptographically random password that rotates on a defined schedule.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Confidentiality (C) | H → L | Credential theft yields only single-machine access; password unique per endpoint and rotated |
| Privileges Required (PR) | H → L | Limits privilege escalation from compromised admin hash; cannot reuse across machines |
| Scope (S) | C → U | Lateral movement prevented; compromised local admin cannot authenticate to other systems |
CWE Relationships
Verification
Verify LAPS policy enforcement and password storage in AD
$ Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd' -Name AdmPwdEnabled -ErrorAction SilentlyContinue | Select-Object -ExpandProperty AdmPwdEnabled
# Expected: 1
# Expected: 1
Platform: windows
$ Get-AdmPwdPassword -ComputerName $env:COMPUTERNAME | Select-Object -ExpandProperty Password
# Expected: <non-empty random password string>
# Expected: <non-empty random password string>
Platform: windows
$ Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd' -Name PasswordComplexity -ErrorAction SilentlyContinue | Select-Object -ExpandProperty PasswordComplexity
# Expected: 4
# Expected: 4
Platform: windows