PowerShell source / read-only remote queries

Validate-WindowsLAPS.ps1

Inspect AD LAPS attributes, safe password metadata, and delegated OU rights without displaying the managed password.

Requirements

A suitable PowerShell environment, the modules/cmdlets named in the source, and authorized access to the target lab systems.

Permissions

Authorized access to the target systems and documented read/delegation rights. Review the source before execution.

Expected output

Console validation output and selected configuration metadata; see source for exact fields.

Safety

Review against your environment before execution. Reports may contain personal or tenant identifiers. Do not publish live exports. This page does not run commands.

GitHub source Related project

Inspect complete script

# Portfolio-safe Windows LAPS validation script
# Does not display the managed password.

param(
    [string]$ComputerName = "WS01"
)

Write-Host "=== Windows LAPS Validation: $ComputerName ==="

Write-Host "`n[1] AD computer and LAPS attribute presence"
Get-ADComputer $ComputerName `
    -Properties msLAPS-PasswordExpirationTime,msLAPS-EncryptedPassword |
Select-Object Name,
    msLAPS-PasswordExpirationTime,
    @{N='EncryptedPasswordPresent';E={[bool]$_.'msLAPS-EncryptedPassword'}}

Write-Host "`n[2] LAPS password metadata"
Get-LapsADPassword -Identity $ComputerName |
Select-Object ComputerName,
    Account,
    PasswordUpdateTime,
    ExpirationTimestamp,
    Source,
    DecryptionStatus,
    AuthorizedDecryptor

Write-Host "`n[3] LAPS OU extended rights"
Find-LapsADExtendedRights `
    -Identity "OU=LAPS-Test,OU=Workstations,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online"