Architecture

Objective

Deploy modern Windows LAPS in a controlled Active Directory test scope using Group Policy, encrypted password storage, and delegated least-privilege access.

Logical path

Administrative laptop -> DC01 -> LAPS-Test OU -> WS01 -> LocalAdmin

The administrative laptop is not domain joined, so domain-integrated administration was performed through DC01 by PowerShell remoting and RDP.

AD and endpoint design

Domain: ad.jeremyfontenot.online
Domain controller / Schema Master: DC01
Domain functional level: Windows Server 2016
Endpoint: WS01
Endpoint OS: Windows 10 Pro build 19045
OU: OU=LAPS-Test,OU=Workstations,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online

LAPS schema

The schema was first queried for msLAPS-* attributes. None were present. Update-LapsADSchema was then run with temporary Schema Admin membership, after which the membership was removed.

Validated attributes:

msLAPS-Password
msLAPS-PasswordExpirationTime
msLAPS-EncryptedPassword
msLAPS-EncryptedPasswordHistory
msLAPS-EncryptedDSRMPassword
msLAPS-EncryptedDSRMPasswordHistory

Group Policy

GPO: GPO - Workstations - Windows LAPS

Settings:

Backup directory: Active Directory
Managed account: LocalAdmin
Password age: 30 days
Password length: 14
Complexity: uppercase + lowercase + numbers + special characters
Password expiration protection: enabled
Password encryption: enabled
Authorized decryptor: JFAD\GG-LAPS-Password-Readers

Delegation

Set-LapsADComputerSelfPermission grants managed computers permission to update their own LAPS attributes. Set-LapsADReadPasswordPermission delegates password-read rights to JFAD\GG-LAPS-Password-Readers.

The final test reader account laps.reader01 belongs only to Domain Users and GG-LAPS-Password-Readers, demonstrating delegated access independent of Domain Admin privileges.