Windows Server 2025 / How to Configure Windows LAPS with Active Directory

Windows Local Administrator Password Solution (Windows LAPS) rotates distinct device-local administrator passwords and supports authorized recovery. For AD backup, prepare schema support, computer write permission, reader and decryption rights, and the computer policy separately.

Choose the account and backup location

This exercise manages the local labadmin account on joined member server FS1 in Lab\Servers. It is not ordinary local-account management on DC1 or DSRM password management. Current Windows LAPS differs from legacy Microsoft LAPS in schema, policies, and commands.

• Check OS, updates, LAPS commands, and policy templates.
• Define a limited administrator group with a real password-recovery need.
• Retain another functioning management and recovery path.
• Check AD encryption prerequisites, including functional-level support.

Use Microsoft’s AD-backed LAPS scenario. The new 2025 lab domain can be assessed for encrypted backup; do not assume every older domain meets the same conditions.

Prepare the custom local administrator on FS1

At FS1’s elevated console, query the name first. If it already exists, stop and review its purpose before running the creation lines. Locate the built-in Administrators group by SID to avoid localized-name differences:

Get-LocalUser -Name 'labadmin' -ErrorAction SilentlyContinue
$initialLocalPassword = Read-Host 'Initial local password' -AsSecureString
New-LocalUser -Name 'labadmin' -Password $initialLocalPassword -Description 'LAPS lab account'
$localAdminGroup = (Get-LocalGroup -SID 'S-1-5-32-544').Name
Add-LocalGroupMember -Group $localAdminGroup -Member "$env:COMPUTERNAME\labadmin"

This manually specified custom-account approach requires you to create the account and membership. It is distinct from a deployment using automatic account management.

Prepare schema and narrowly delegated AD access

Schema extension is a forest-level change, not something undone by deleting a GPO link. In production, approve its change and recovery plan first. In the isolated lab, use the appropriate schema privileges:

Update-LapsADSchema
Set-LapsADComputerSelfPermission -Identity 'OU=Servers,OU=Lab,DC=ad,DC=example,DC=test'

Computer self-permission permits a computer to update its own LAPS data, not arbitrary administrators to read it. Create the following reader group only if absent, and add only designated management identities:

New-ADGroup -Name 'GG_LAPSReaders' -GroupCategory Security -GroupScope Global -Path 'OU=LabGroups,OU=Lab,DC=ad,DC=example,DC=test'
Set-LapsADReadPasswordPermission -Identity 'OU=Servers,OU=Lab,DC=ad,DC=example,DC=test' -AllowedPrincipals 'AD\GG_LAPSReaders'
Find-LapsADExtendedRights -Identity 'OU=Servers,OU=Lab,DC=ad,DC=example,DC=test'

Read access and encrypted-password decryption authority are separate. Inspect existing extended rights for unintended broad access. Review the LAPS PowerShell commands before changing delegation.

Link the policy only to the test server scope

1. Create Lab-LAPS-Servers and link it to Lab\Servers. Inspect the computers there; use a separate test OU if real servers are mixed in.
2. Open Computer Configuration → Policies → Administrative Templates → System → LAPS. Check current ADMX and matching-language ADML files if using a central store.
3. Choose Windows Server Active Directory as the backup directory.
4. Set the managed administrator account name to labadmin.
5. Enable password encryption and select AD\GG_LAPSReaders as the authorized decryption principal.
6. For the lab, use length 20, complexity 4, and age 30 days, checking local policy compatibility.

These values are examples. LAPS policy documentation describes supported settings and OS conditions. Newer passphrase or account-management options cannot be indiscriminately applied to older clients.

Verify processing, recovery rights, and cleanup

On FS1, apply computer policy and request processing. Examine Microsoft → Windows → LAPS → Operational in Event Viewer:

gpupdate /target:computer /force
Invoke-LapsPolicyProcessing

An authorized administrator can inspect metadata on the AD management PC without displaying the password string:

Get-LapsADPassword -Identity 'FS1' | Select-Object ComputerName,Account,PasswordUpdateTime,ExpirationTimestamp,DecryptionStatus

Verify device, account, update and expiration times, and decryption status according to the installed module. Ordinary unauthorized users must not retrieve the secret. Any actual password recovery should avoid screen sharing, transcripts, and logs. Password retrieval and successful login to the intended local account are separate checks.

Disabling policy does not restore an old password. First verify another management path, arrange a new unique password if retiring LAPS, and remove only the intended policy and delegation. Do not delete schema attributes or return every server to a common password.