Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000204

Windows LAPS not configured or AD prerequisites missing

Medium
Active Directory
Credential Access Lateral Movement Privilege Escalation

Signature Identity

CTD-000204
Threat ID
Version
IOE
Indicator Type

Threat Description

Windows Local Administrator Password Solution (Windows LAPS) helps protect local administrator accounts by automatically rotating passwords and backing them up to Windows Server Active Directory or Microsoft Entra ID. Windows LAPS is built into supported Windows 10, Windows 11, and Windows Server versions that have the April 11, 2023 update or later.

If Windows LAPS is not configured, if the required policy is missing, or if Active Directory prerequisites are incomplete, local administrator passwords might not be rotated or backed up securely. This can leave devices using static or reused local administrator passwords and increase the risk of credential reuse, pass-the-hash attacks, and lateral movement.

For Active Directory backup, the Windows LAPS schema attributes must be added to the forest. To use encrypted password storage in Active Directory, the domain must run at Windows Server 2016 domain functional level or later. Hybrid-joined devices can back up Windows LAPS passwords to either Microsoft Entra ID or Windows Server Active Directory, but not both.

Legacy Microsoft LAPS is deprecated on newer Microsoft operating systems. Organizations should plan migration to Windows LAPS to use modern capabilities such as native OS support, password encryption in Active Directory, password history, and Microsoft Entra ID integration.

MITRE ATT&CK: Attack Tactics

Credential Access Lateral Movement Privilege Escalation

D3FEND: Defend Tactics

Credential Hardening

Remediation

  1. Verify the intended Windows LAPS backup location.
    • Use Windows Server Active Directory for AD-joined devices.
    • For hybrid-joined devices, choose either Microsoft Entra ID or Windows Server Active Directory. Do not configure both as backup locations.
  2. If backing up passwords to Active Directory, update the AD schema for Windows LAPS:
    Update-LapsADSchema
  3. Verify that the Windows LAPS schema attributes exist:
    Get-ADObject -LDAPFilter "(cn=msLAPS-PasswordExpirationTime)" -SearchBase "CN=Schema,CN=Configuration,DC=yourdomain,DC=com"
  4. Grant managed devices permission to update their Windows LAPS password attributes on the target OU:
    Set-LapsADComputerSelfPermission -Identity "OU=Workstations,DC=yourdomain,DC=com"
  5. If encrypted password storage in Active Directory is required, verify that the domain functional level is Windows Server 2016 or later:
    Get-ADDomain | Select-Object DomainMode
  6. If needed, raise the domain and forest functional levels only after validating domain controller compatibility and change-management requirements:
    Set-ADDomainMode -Identity "yourdomain.com" -DomainMode Windows2016Domain
    Set-ADForestMode -Identity "yourdomain.com" -ForestMode Windows2016Forest
  7. Configure Windows LAPS by using Group Policy:
    • Open Group Policy Management Console.
    • Go to Computer Configuration > Administrative Templates > System > LAPS.
    • Enable Configure password backup directory.
    • Set Backup directory to Active Directory or Microsoft Entra ID, depending on the intended backup location.
    • Enable password encryption if backing up to Active Directory and the domain functional level supports it.
    • Enable password expiration protection.
    • Configure password age, length, and complexity according to your security policy.
  8. If using Microsoft Intune:
    • Open the Microsoft Intune admin center.
    • Go to Endpoint security > Account protection.
    • Create or update a Windows LAPS policy.
    • Set the backup directory to Microsoft Entra ID or Active Directory, depending on the device join state and deployment design.
    • Configure password age, complexity, and encryption-related settings as required.
  9. Confirm that Windows LAPS is working:
    • Verify that targeted devices receive the policy.
    • Check the Windows LAPS event log on managed devices.
    • Confirm that passwords are being rotated and backed up to the selected directory.
    • Verify that only authorized administrators can retrieve Windows LAPS passwords.

Frequently Asked Questions

What does Windows LAPS not configured or AD prerequisites missing mean?

The absence of required policy configurations or incomplete Active Directory prerequisites allows devices to use static or reused local administrator passwords, which can be exploited by attackers. This enables unauthorized access to devices and data through lateral movement.

This vulnerability is considered medium severity because it enables credential reuse and pass-the-hash attacks, allowing attackers to obtain elevated privileges and move laterally within the network. This can lead to further unauthorized access and data compromise.

Attackers can exploit this vulnerability by using static or reused local administrator passwords for authentication, which can be used to obtain elevated privileges and move laterally within the network. This supports further unauthorized access and data compromise.

Cayosoft Guardian monitors Active Directory for policy configuration gaps and incomplete prerequisites, providing visibility into potential security risks and enabling proactive remediation. This helps administrators identify affected devices and take corrective action.

Cayosoft Guardian helps administrators detect and address this vulnerability by flagging affected devices, providing recommendations for configuration changes, and enabling them to review and validate their security posture. This supports investigation and response efforts.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Account protection Privileged Access Management
Attack Tactics
Credential Access Lateral Movement Privilege Escalation
Defend Tactics
Credential Hardening
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical