Sanitized validation evidence

Windows LAPS & Advanced Group Policy

Portfolio-safe evidence reconstructed from the completed lab validation. No managed password is displayed.

Back to case studyBack to proof

Schema extension

msLAPS-EncryptedDSRMPassword
msLAPS-EncryptedDSRMPasswordHistory
msLAPS-EncryptedPassword
msLAPS-EncryptedPasswordHistory
msLAPS-Password
msLAPS-PasswordExpirationTime

Final encrypted retrieval

ComputerName        : WS01
Account             : LocalAdmin
Source              : EncryptedPassword
DecryptionStatus    : Success
AuthorizedDecryptor : JFAD\GG-LAPS-Password-Readers

Effective policy

Policy source: GPO
Backup directory: Active Directory
Local administrator account name: LocalAdmin
Password age in days: 30
Password complexity: 4
Password length: 14
Password encryption enabled: 1

Rotation events

10014 - Administrator initiated update
10020 - LocalAdmin password updated
10018 - Active Directory updated
10004 - LAPS processing succeeded

Negative access test

ACCESS TEST RESULT:
No LAPS record returned for unauthorized user.

AD attribute presence

Computer: WS01
EncryptedPasswordPresent: True