Windows LAPS & Advanced Group Policy

Windows LAPS & Advanced Group Policy

Status

COMPLETE

This project demonstrates a validated deployment of modern Windows LAPS in the ad.jeremyfontenot.online Active Directory lab using a dedicated test OU, Group Policy, encrypted password storage, least-privilege delegation, event-log validation, and forced password rotation.

Environment

Validated controls

• Modern Windows LAPS module present on DC01 and WS01
• AD schema inspected before modification
• Update-LapsADSchema completed and six msLAPS-* attributes validated
• Dedicated LAPS-Test OU created and WS01 moved into scope
• Computer self-permission delegated with Set-LapsADComputerSelfPermission
• Dedicated password-reader group created and delegated with Set-LapsADReadPasswordPermission
• GPO configured for AD backup, 30-day age, 14-character complex passwords, encrypted storage, and an authorized decryptor group
• gpupdate, gpresult, and GUI Group Policy Results/RSOP validated
• Windows LAPS Event IDs 10021, 10020, 10018, 10014, and 10004 validated
• Delegated non-admin retrieval succeeded
• Unauthorized standard-user retrieval returned no LAPS record
• Forced password rotation changed the password update and expiration timestamps

Security design

The built-in RID-500 Administrator account remains disabled. Windows LAPS manages the existing enabled WS01\LocalAdmin account instead. Passwords are stored using encrypted Windows LAPS attributes in Active Directory. The actual password is intentionally excluded from all portfolio evidence.

Documentation

• Architecture
• Implementation
• Validation
• Troubleshooting
• Lessons learned
• Sanitized evidence
• Validation script

Architecture

Objective

Deploy modern Windows LAPS in a controlled Active Directory test scope using Group Policy, encrypted password storage, and delegated least-privilege access.

Logical path

Administrative laptop -> DC01 -> LAPS-Test OU -> WS01 -> LocalAdmin

The administrative laptop is not domain joined, so domain-integrated administration was performed through DC01 by PowerShell remoting and RDP.

AD and endpoint design

• Domain: ad.jeremyfontenot.online
• Domain controller / Schema Master: DC01
• Domain functional level: Windows Server 2016
• Endpoint: WS01
• Endpoint OS: Windows 10 Pro build 19045
• OU: OU=LAPS-Test,OU=Workstations,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online

LAPS schema

The schema was first queried for msLAPS-* attributes. None were present. Update-LapsADSchema was then run with temporary Schema Admin membership, after which the membership was removed.

Validated attributes:

• msLAPS-Password
• msLAPS-PasswordExpirationTime
• msLAPS-EncryptedPassword
• msLAPS-EncryptedPasswordHistory
• msLAPS-EncryptedDSRMPassword
• msLAPS-EncryptedDSRMPasswordHistory

Group Policy

GPO: GPO - Workstations - Windows LAPS

Settings:

• Backup directory: Active Directory
• Managed account: LocalAdmin
• Password age: 30 days
• Password length: 14
• Complexity: uppercase + lowercase + numbers + special characters
• Password expiration protection: enabled
• Password encryption: enabled
• Authorized decryptor: JFAD\GG-LAPS-Password-Readers

Delegation

Set-LapsADComputerSelfPermission grants managed computers permission to update their own LAPS attributes. Set-LapsADReadPasswordPermission delegates password-read rights to JFAD\GG-LAPS-Password-Readers.

The final test reader account laps.reader01 belongs only to Domain Users and GG-LAPS-Password-Readers, demonstrating delegated access independent of Domain Admin privileges.

Sanitized Evidence Index

This folder contains portfolio-safe evidence reconstructed from the validated command output captured during the lab. Managed passwords and authentication secrets are intentionally excluded.

Core evidence

• Validated results
• Troubleshooting evidence

Security handling

Never publish:

• Windows LAPS managed passwords
• domain passwords
• recovery secrets
• private keys
• tokens
• VPN credentials

The repository intentionally records only non-secret metadata such as account name, timestamps, encryption source, decryption status, authorized decryptor, event IDs, and GPO configuration.

Troubleshooting Evidence

RDP

• TCP 3389 to DC01: reachable
• Local client failure: mstsc.exe AppHangB1 / Event ID 1002
• Working launch: mstsc /public /admin /v:dc01.ad.jeremyfontenot.online

WMI / RSOP

Initial WMI result:

The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)

WMI firewall rule source:

PolicyStoreSourceType : Local
PolicyStoreSource     : PersistentStore
Enabled               : False
Profile               : Domain

After enabling the Domain-profile PersistentStore WMI rules:

CSName  : WS01
Caption : Microsoft Windows 10 Pro
Version : 10.0.19045

The Group Policy Results wizard then completed successfully.

Windows LAPS Validated Results

Schema extension

Post-extension query returned all required modern attributes:

msLAPS-EncryptedDSRMPassword
msLAPS-EncryptedDSRMPasswordHistory
msLAPS-EncryptedPassword
msLAPS-EncryptedPasswordHistory
msLAPS-Password
msLAPS-PasswordExpirationTime

OU and delegation

WS01 final OU:

OU=LAPS-Test,OU=Workstations,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online

Extended-right holders:

NT AUTHORITY\SYSTEM
JFAD\Domain Admins
JFAD\GG-LAPS-Password-Readers

Final reader group membership:

Name           : LAPS Reader Test
SamAccountName : laps.reader01
ObjectClass    : user

laps.reader01 group memberships:

Domain Users
GG-LAPS-Password-Readers

GPO application

gpresult /r /scope computer included:

GPO - Workstations - Windows LAPS

Effective policy - Event 10021

Policy source: GPO
Backup directory: Active Directory
Local administrator account name: LocalAdmin
Password age in days: 30
Password complexity: 4
Password length: 14
Password expiration protection enabled: 1
Password encryption enabled: 1
Password encryption target principal: JFAD\GG-LAPS-Password-Readers

Final encrypted retrieval

ComputerName        : WS01
Account             : LocalAdmin
PasswordUpdateTime  : 9/11/2026 7:06:17 PM
ExpirationTimestamp : 10/11/2026 7:06:17 PM
Source              : EncryptedPassword
DecryptionStatus    : Success
AuthorizedDecryptor : JFAD\GG-LAPS-Password-Readers

AD attribute presence

Name                          : WS01
msLAPS-PasswordExpirationTime : 134362343115244738
EncryptedPasswordPresent      : True

Final rotation events

10014 - Administrator-initiated password update
10020 - LocalAdmin password successfully updated
10018 - Active Directory successfully updated
10004 - LAPS policy processing succeeded

Negative access test

ACCESS TEST RESULT: No LAPS record returned for unauthorized user.

No managed password value is present in this evidence.

Implementation

1. Validated the modern LAPS PowerShell module on DC01 and WS01.
2. Queried the AD schema for msLAPS-* attributes before making changes.
3. Temporarily added jeremy.fontenot to Schema Admins, refreshed the logon token, and ran Update-LapsADSchema -Verbose.
4. Verified all six modern Windows LAPS schema attributes and removed the temporary Schema Admin membership.
5. Created OU=LAPS-Test under OU=Workstations with accidental-deletion protection.
6. Moved WS01 from the existing Windows 10 OU into LAPS-Test.
7. Delegated computer self-permission with Set-LapsADComputerSelfPermission.
8. Created GG-LAPS-Password-Readers and delegated read permission with Set-LapsADReadPasswordPermission.
9. Created and linked GPO - Workstations - Windows LAPS to the LAPS-Test OU.
10. Configured AD backup, 30-day age, 14-character complex passwords, encryption, and GG-LAPS-Password-Readers as the authorized decryptor.
11. Initially allowed LAPS to target the built-in Administrator account. Event ID 10067 showed that the account was disabled.
12. Reviewed WS01 local Administrators and found the existing enabled LocalAdmin account.
13. Updated the GPO to manage LocalAdmin rather than enabling the built-in Administrator account.
14. Forced Group Policy processing and validated the effective policy through Event ID 10021.
15. Created non-admin reader account laps.reader01, added it to the reader group, and validated encrypted retrieval.
16. Created a temporary unauthorized standard user and confirmed it could not retrieve the LAPS record; the account was then deleted.
17. Forced a final Reset-LapsPassword and validated the new timestamps and Event IDs 10014, 10020, 10018, and 10004.

Lessons Learned

• Verify msLAPS-* schema state before running Update-LapsADSchema.
• Use temporary privilege for schema changes and remove it immediately afterward.
• Scope testing to a dedicated OU rather than broad workstation containers.
• Separate LAPS password-read rights from Domain Admin privileges.
• Prefer encrypted password storage and an explicit decryptor group.
• Select the managed account intentionally; LAPS can rotate a disabled account, but that does not make the account usable for recovery.
• Event IDs 10021, 10020, 10018, 10014, and 10004 provide strong operational evidence.
• gpresult and GUI RSOP validate complementary layers of Group Policy application.
• Troubleshoot the failing layer from evidence: transport, WMI/RPC, firewall policy source, policy application, and finally LAPS processing.
• Portfolio evidence should show timestamps, source, account, decryption status, and authorization metadata while excluding the password itself.

Troubleshooting

RDP client hang

TCP 3389 to DC01 was reachable, but the local Remote Desktop Connection client hung or closed. Windows Error Reporting showed mstsc.exe AppHangB1 / Application Hang Event ID 1002.

Resolution:

mstsc /public /admin /v:dc01.ad.jeremyfontenot.online

The administrative RDP session then opened successfully.

RSOP / WMI RPC failure

The Group Policy Results wizard initially failed to query WS01. A direct WMI test returned 0x800706BA - The RPC server is unavailable.

Inspection showed all Windows Management Instrumentation (WMI) firewall rules were disabled and originated from the local PersistentStore.

The Domain-profile WMI rules were enabled in PersistentStore. A subsequent Get-WmiObject Win32_OperatingSystem -ComputerName WS01 succeeded and the GUI Group Policy Results report generated correctly.

Disabled built-in Administrator

LAPS Event ID 10067 reported that the built-in Administrator account was disabled. WS01 already had an enabled custom LocalAdmin account in the local Administrators group.

The LAPS GPO was updated to manage LocalAdmin. Event IDs 10021 and 10020 then confirmed the intended account and successful password update.

Reader account could not WinRM to DC01

laps.reader01 intentionally lacked administrative/WinRM rights on DC01. Rather than granting unnecessary remote-administration permission, Get-LapsADPassword -Credential and -DecryptionCredential were used inside the existing administrative remoting session to validate the delegated reader credentials.

Validation

Group Policy

gpupdate /force completed successfully on WS01. gpresult /r /scope computer listed GPO - Workstations - Windows LAPS under Applied Group Policy Objects. The Group Policy Results wizard was also generated after WMI/RPC remediation.

Effective policy

Event ID 10021 reported:

Policy source: GPO
Backup directory: Active Directory
Local administrator account name: LocalAdmin
Password age in days: 30
Password complexity: 4
Password length: 14
Password expiration protection enabled: 1
Password encryption enabled: 1
Password encryption target principal: JFAD\GG-LAPS-Password-Readers

AD backup and retrieval

Sanitized final retrieval:

ComputerName        : WS01
Account             : LocalAdmin
PasswordUpdateTime  : 9/11/2026 7:06:17 PM
ExpirationTimestamp : 10/11/2026 7:06:17 PM
Source              : EncryptedPassword
DecryptionStatus    : Success
AuthorizedDecryptor : JFAD\GG-LAPS-Password-Readers

The Password property was deliberately excluded.

Forced rotation

Event sequence:

• 10014 - administrator-initiated password update
• 10020 - LocalAdmin password updated
• 10018 - Active Directory updated with the new password
• 10004 - LAPS policy processing succeeded

Least privilege

laps.reader01 was validated with only Domain Users and GG-LAPS-Password-Readers memberships and successfully decrypted the encrypted LAPS record.

A standard user outside the reader group produced:

ACCESS TEST RESULT: No LAPS record returned for unauthorized user.

AD attribute presence

Name                          : WS01
msLAPS-PasswordExpirationTime : 134362343115244738
EncryptedPasswordPresent      : True