Windows LAPS Validated Results

Schema extension

Post-extension query returned all required modern attributes:

msLAPS-EncryptedDSRMPassword
msLAPS-EncryptedDSRMPasswordHistory
msLAPS-EncryptedPassword
msLAPS-EncryptedPasswordHistory
msLAPS-Password
msLAPS-PasswordExpirationTime

OU and delegation

WS01 final OU:

OU=LAPS-Test,OU=Workstations,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online

Extended-right holders:

NT AUTHORITY\SYSTEM
JFAD\Domain Admins
JFAD\GG-LAPS-Password-Readers

Final reader group membership:

Name           : LAPS Reader Test
SamAccountName : laps.reader01
ObjectClass    : user

laps.reader01 group memberships:

Domain Users
GG-LAPS-Password-Readers

GPO application

gpresult /r /scope computer included:

GPO - Workstations - Windows LAPS

Effective policy - Event 10021

Policy source: GPO
Backup directory: Active Directory
Local administrator account name: LocalAdmin
Password age in days: 30
Password complexity: 4
Password length: 14
Password expiration protection enabled: 1
Password encryption enabled: 1
Password encryption target principal: JFAD\GG-LAPS-Password-Readers

Final encrypted retrieval

ComputerName        : WS01
Account             : LocalAdmin
PasswordUpdateTime  : 9/11/2026 7:06:17 PM
ExpirationTimestamp : 10/11/2026 7:06:17 PM
Source              : EncryptedPassword
DecryptionStatus    : Success
AuthorizedDecryptor : JFAD\GG-LAPS-Password-Readers

AD attribute presence

Name                          : WS01
msLAPS-PasswordExpirationTime : 134362343115244738
EncryptedPasswordPresent      : True

Final rotation events

10014 - Administrator-initiated password update
10020 - LocalAdmin password successfully updated
10018 - Active Directory successfully updated
10004 - LAPS policy processing succeeded

Negative access test

ACCESS TEST RESULT: No LAPS record returned for unauthorized user.

No managed password value is present in this evidence.