Schema
Post-extension validation returned all six modern Windows LAPS schema attributes, including encrypted password and expiration attributes.
Sanitized validation evidence
Windows LAPS & Advanced Group Policy
A recruiter-friendly view of the evidence used to validate the project. Managed passwords and authentication secrets are intentionally excluded.
Validation summary
What was directly observed
Group Policy
WS01 applied GPO - Workstations - Windows LAPS. Effective policy used Active Directory backup, a 30-day password age, 14-character complexity policy, encryption, and the managed LocalAdmin account.
Encrypted retrieval
ComputerName : WS01 Account : LocalAdmin Source : EncryptedPassword DecryptionStatus : Success AuthorizedDecryptor : JFAD\GG-LAPS-Password-Readers
Least privilege
A standard user in GG-LAPS-Password-Readers successfully retrieved LAPS metadata through delegated credentials. A separate unauthorized standard user received no LAPS record.
Forced rotation
Event IDs 10014, 10020, 10018, and 10004 documented the administrator-initiated rotation, local account update, Active Directory backup, and successful policy processing.
AD attribute presence
Name : WS01 EncryptedPasswordPresent : True
The encrypted password value itself was never displayed in public evidence.
Security boundary
Evidence proves configuration and behavior, not secret disclosure.
No managed LAPS password, domain password, token, VPN credential, private key, recovery key, or other authentication secret is published.