# LAPS

\#powershell

## Group Policy

* Changing local administrator password in all the machines is a difficult task.
* This is usually done through Group Policies Preferences.
* The passwords are propagated through XML files via the SYSVOL directory, and the password is encrypted with the AES256 encryption.
* Microsoft published this key in the documentation. Hence this method is considered insecure.

## LAPS

* Local administrator password solution was introduced as a secure way of changing local administrator password on workstations.
* Computer objects have LAPS attribute:
  * `ms-Mcs-AdmPwd`: confidential attribute that stores create text administrator password.
  * `ms-Mcs-AdmPwdExpirationTime`: contains the password expiration time.
* `C:\Program Files\LAPS\CSE\AdmPwd.dll` will be present if LAPS is enabled on the target workstation.
* Extended rights can be enumerated using laps powershell commands

```powershell
# This will print which pricipal has LAPS extended rights over MyOU 
Find-AdmPwdExtendedRights -Identity "MyOU"
```

* After compromising the user which holds LAPS extended rights over the OU, we print the password.

```powershell
Get-AdmPwdPassword -ComputerName mycomputer
```
