Windows LAPS & Advanced Group Policy
Status
COMPLETE
This project demonstrates a validated deployment of modern Windows LAPS in the ad.jeremyfontenot.online Active Directory lab using a dedicated test OU, Group Policy, encrypted password storage, least-privilege delegation, event-log validation, and forced password rotation.
Environment
| Component | Configuration |
|---|---|
| AD domain | ad.jeremyfontenot.online |
| NetBIOS | JFAD |
| Domain controller | DC01 - Windows Server 2022 |
| Test endpoint | WS01 - Windows 10 Pro 10.0.19045 |
| Test OU | OU=LAPS-Test,OU=Workstations,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online |
| LAPS GPO | GPO - Workstations - Windows LAPS |
| Managed account | LocalAdmin |
| Reader group | JFAD\GG-LAPS-Password-Readers |
Validated controls
- Modern Windows LAPS module present on DC01 and WS01
- AD schema inspected before modification
Update-LapsADSchemacompleted and sixmsLAPS-*attributes validated- Dedicated
LAPS-TestOU created and WS01 moved into scope - Computer self-permission delegated with
Set-LapsADComputerSelfPermission - Dedicated password-reader group created and delegated with
Set-LapsADReadPasswordPermission - GPO configured for AD backup, 30-day age, 14-character complex passwords, encrypted storage, and an authorized decryptor group
gpupdate,gpresult, and GUI Group Policy Results/RSOP validated- Windows LAPS Event IDs 10021, 10020, 10018, 10014, and 10004 validated
- Delegated non-admin retrieval succeeded
- Unauthorized standard-user retrieval returned no LAPS record
- Forced password rotation changed the password update and expiration timestamps
Security design
The built-in RID-500 Administrator account remains disabled. Windows LAPS manages the existing enabled WS01\LocalAdmin account instead. Passwords are stored using encrypted Windows LAPS attributes in Active Directory. The actual password is intentionally excluded from all portfolio evidence.