Anyone else here used LAPS (Local Admin Password Service)?

[phreak]

Hi All,

 

 

For those of you who don't know LAPS is a Microsoft supplied bit of software that should connect into AD and allow for resetting and reading of a local admin password.

 

I recently installed LAPS onto my system. But the issue is that sometimes the password resets after a little time, and sometimes the password never sets a password.

 

The Password Expiry time changes every time I do a request. If I do it in the GUI it always said password reset request was successful. I have tried it in powershell as well.

 

I went through all the following steps.

 

Installed Laps (both on my management server and DC)

 

Import-Module AdmPwd.Ps

 

Update-AdmPwdSchema

 

Went and checked and after that I have the ms-MCS-AdmExpirationTime and ms-Mcs-AdmPwd attributes.

 

Then I ran

 

Set-AdmPwdComputerSelfPermission -Identity Workstations

 

Set-AdmPwdReadPasswordPermission -OrgUnit Workstations -AllowedPrincipals Myuser

 

I also tried running

 

Set-AdmPwdResetPermission -Orgunit Workstations -AllowedPrincipals Myuser

 

 

Oh and I have gone and configured all the necessary GPO's and distributed them to the workstations in question.

 

If I go into a computer in that OU and look at the effective permissions Myuser has full control and is allowed to change the ms-mcs attributes. Self has access to Write ms-Mcs-AdmPwd and Ms-Mcs-AdmPwdExpirationTime and Read ms-Mcs-AdmPwdExpirationTime.

 

Is there something that I am missing here?

[glen_j]

take a look at this https://gallery.technet.microsoft.com/step-by-step-deploy-local-7c9ef772/file/150657/1/step%20by%20step%20guide%20to%20deploy%20microsoft%20laps.pdf it looks like you need to specify the OU when running the Set-AdmPwdComputerSelfPermission -Identity Workstations

part.

[phreak]

Thanks, though sadly I have read that and tried using the specific distinguished name of the OU and still the same thing.

 

I just ran a Find-AdmPwdExtendedRights -Identity "Workstations" and it comes up with myuser as ExtendedRightsHolder so that says to me that I should have rights to do this password reset.

[glen_j]

Isn't it the computer account that sets the password and writes to AD? might be worth checking the computer has permissions in AD

[glen_j]

needs to have SELF permission set to allow write to ms-Mcs-AdmPwd and read - write to ms-Mcs-AdmPwd ExpirationTime Edited February 27, 2019 by glen_j

[glen_j]

What gui / powershell command are you using to rest the password?

[phreak]

Yes, Self has been given permission to write but not read the password. Using the LAPS GUI but have also tried this

 

Reset-AdmPwdPassword -ComputerName Workstation1 -WhenEffective "09/09/2019 15:00"

[CHSGM]

Yep. Stores cred within the AD object and works very well. Passwords recycle every 60 days.

[glen_j]

try just running Reset-AdmPwdPassword -ComputerName Workstation1 and the either restart or run gpupdate

[chazzy2501]

having trouble early, I've installed the laps on my workstation with extras. I've opened PowerShell as admin and imported the module, when I go to update-admpwdschema is says I have insufficient access rights. (I'm running as a domain admin but I've also added myself as a schema admin in case)

 

 

I'm just running PowerShell on my desktop does it have to be a special active directory PowerShell? (like exchange)

[phreak]

I did manage to get this running in the end. My issue was that there was some non-standard stuff out there as well as some servers not being able to access the installer file location, which meant the GPO didn't deploy as intended. The non standard stuff was that the local admin account had been renamed and therefore I couldn't reset the password as the account I was trying to reset was not there.

 

Chazzy, no special Powershell, but you do need to run powershell it as an administrator. Oh and check because I had to update my powershell to allow me to update the schema.

[chazzy2501]

thank @phreak, reading the documentation in the GPO the default admin account is identified by it's SID so it can automatically detect it even if you've changed the name.

 

I had to load the active directory module before my PowerShell would work with the instructions... (so not a permission error at btw)

 

Also it doesn't mention that you need to dig into your local policydefs to copy them over to your policy store!

 

questions:

 

I added the self write permissions to the highest OU, I assume that all OUs below this will allow the PCs within them to get the required perms?

 

I did check that domain admins has the rights to see the extended attributes but I can't see them in AD extended attributes? Does the software have run before those fields appear? I expected to see them but empty.

[chazzy2501]

update: I can see the fields in the ADSI editor but not active directory. How come? is this expected?

[chazzy2501]

ok, using the LAPS ui, I can see the password and expire time. BUT I has only set the default admin, not the 2 other admin accounts that are created when I made the image. (the one for the image and the one when I deploy) I'll see if I can delete them using GPP.

 

The local admin is disabled anyhow?

[phreak]

Hi Chazzy,

 

If you have run the Schema update command onto the correct domain/OU then you should see the fields in AD (Under Attribute Editor). You can go to Security, Advanced and Effective permissions and check to make sure that Self has Read/Write for ms-Mcs-AdmPwdExpirationTime and Write access to ms-Mcs-AdmPwd.

Your account should have the same, but also have Read ms-Mcs-AdmPwd.

 

You would normally say which admin account you are going to set the password for in the Group policy. And the account must be enabled.

In the end I changed it to reset the Alternative Admin account (not default Administrator account) and once I was sure all of the machines had said account it was fine.