Jeremy Fontenot / Technical portfolio

Windows LAPS & Advanced Group Policy

Practical administration. Documented results. Original technical evidence.

Objective and implementation

Demonstrate a bounded Windows LAPS access and rotation workflow in a personal AD lab. Technologies: Windows LAPS, Active Directory, Group Policy, and PowerShell.

The retained schema output lists modern msLAPS attributes. The retrieval result identifies an EncryptedPassword source, successful decryption, and the delegated reader group. Password values are intentionally absent.

Troubleshooting and control checks

Compare authorized retrieval with the standard-user negative test. The latter returned no LAPS record through the tested path. The rotation record identifies events 10014, 10020, 10018, and 10004. These sanitized results support the specific tests below; broader GPO configuration is not independently reconstructed here.

Scope and limitations

Personal Active Directory lab. The linked sanitized records support modern schema attributes, authorized encrypted retrieval, the tested negative access path, and recorded forced-rotation events. Actual passwords are excluded.

Registry status retained in the audit: COMPLETE . Evidence below is assessed by artifact type; this package does not rerun the lab.

Read the retained project registry and its stated scope

Tasks, results, and supporting proof

Evidence 1

Retained schema validation records the modern msLAPS attributes required for AD-backed Windows LAPS.

Open 01-schema-attributes.txtconfirmed: schema attribute list and PASS result inspected

Provenance

Source: projects/windows-laps-gpo/evidence/01-schema-attributes.txt

SHA-256: f831ca48d03e7efc27d66f1c5695a97c30f45907052203c90a40353d12ed3622

Evidence 2

The tested unauthorized standard-user retrieval path returned no LAPS record.

Open 14-laps-unauthorized-access-denied.txtconfirmed: exact negative-test result inspected

Provenance

Source: projects/windows-laps-gpo/evidence/14-laps-unauthorized-access-denied.txt

SHA-256: 6e9180ce0d8ea0427a89c8813fea3938828ca540aedbfd71f94bc31da4de86bd

Evidence 3

Retained events record administrator-initiated rotation, local password update, AD update, and successful policy processing.

Open 13-laps-forced-rotation-events.txtconfirmed: events 10014, 10020, 10018 and 10004 inspected

Provenance

Source: projects/windows-laps-gpo/evidence/13-laps-forced-rotation-events.txt

SHA-256: e26c2611c39b7c2cc1f7b444373634b1f0471171b2fcfb774e6a0e08c5be92af

Evidence 4

Sanitized retrieval evidence records a successful authorized LAPS retrieval.

Open 12-laps-final-retrieval-success.txtconfirmed within sanitized result; password values are excluded

Provenance

Source: projects/windows-laps-gpo/evidence/12-laps-final-retrieval-success.txt

SHA-256: a820515f73bf40560b97624540bc2451649b3e2d57578628c05700da17a506cd