Implementation

Implementation

1. Validated the modern LAPS PowerShell module on DC01 and WS01.
2. Queried the AD schema for msLAPS-* attributes before making changes.
3. Temporarily added jeremy.fontenot to Schema Admins, refreshed the logon token, and ran Update-LapsADSchema -Verbose.
4. Verified all six modern Windows LAPS schema attributes and removed the temporary Schema Admin membership.
5. Created OU=LAPS-Test under OU=Workstations with accidental-deletion protection.
6. Moved WS01 from the existing Windows 10 OU into LAPS-Test.
7. Delegated computer self-permission with Set-LapsADComputerSelfPermission.
8. Created GG-LAPS-Password-Readers and delegated read permission with Set-LapsADReadPasswordPermission.
9. Created and linked GPO - Workstations - Windows LAPS to the LAPS-Test OU.
10. Configured AD backup, 30-day age, 14-character complex passwords, encryption, and GG-LAPS-Password-Readers as the authorized decryptor.
11. Initially allowed LAPS to target the built-in Administrator account. Event ID 10067 showed that the account was disabled.
12. Reviewed WS01 local Administrators and found the existing enabled LocalAdmin account.
13. Updated the GPO to manage LocalAdmin rather than enabling the built-in Administrator account.
14. Forced Group Policy processing and validated the effective policy through Event ID 10021.
15. Created non-admin reader account laps.reader01, added it to the reader group, and validated encrypted retrieval.
16. Created a temporary unauthorized standard user and confirmed it could not retrieve the LAPS record; the account was then deleted.
17. Forced a final Reset-LapsPassword and validated the new timestamps and Event IDs 10014, 10020, 10018, and 10004.