New LAPS (April 2023 updates)

[Garacesh]

Well I'm glad it's a native part of Windows now, but this new version is becoming a bit more of a hassle than the old MSI flavour!

 

So.. I have confirmed the machines have installed the April 2023 update, and have LAPS available, due to the presence of C:\Windows\System32\Laps.dll

 

I have extended my directory schema by executing Update-LapsADSchema, and granted Domain Admins read and write permissions via Set-LapsADReadPasswordPermission -allowedprincipals "Domain Admins" -Identity 'DC=domain,DC=com' and Set-LapsADResetPasswordPermission -allowedprincipals "Domain Admins" -Identity 'DC=domain,DC=com'

 

I have enforced LAPS via InTune, keeping the default settings

Do not allow password expiration time longer than required by policy: Enabled

Enable local admin password management: Enabled

Password Settings: Enabled

Password Age (Days) (Device): 30

Password Complexity (Device): Large letters + small letters + numbers + specials

Password Length (Device): 14

 

I can confirm the Enable local admin password management, Do not allow password expiration time longer than required by policy and Password settings policies are applying successfully, thanks to the Per setting status report.

 

The LAPS tab does appear in computer object properties in AD Users and Computers

 

BBBUUUUUTTTTT.. When I check the devices in AD that have successfully applied the policy as my domain admin account, all the fields are still blank. The msLAPS-EncryptedDSRMPassword, msLAPS-EncryptedDSRMPasswordHistory, msLAPS-EncryptedPassword, msLAPS-EncryptedPasswordHistory, msLAPS-Password and msLAPS-PasswordExpirationTime are all showing as in Attribute Editor

 

Probably going to be something derpy I've missed but.. What have I missed?

[Jobos]

I got it working by following this guide https://ourcloudnetwork.com/how-to-setup-windows-laps-step-by-step/ but I didn't have the old LAPS running which may have helped.

[Garacesh]

I got it working by following this guide https://ourcloudnetwork.com/how-to-setup-windows-laps-step-by-step/ but I didn't have the old LAPS running which may have helped.

 

Aha, just before you posted that I found yet another Microsoft article detailing the Set-LapsADComputerSelfPermission cmdlet that lets a device actually set its own password - makes sense! So I've set that and told 2 machines to expire their passwords, fingers crossed!

 

I'll take a more detailed look at that article if this falls flat. Thank you

 

Edit:

Hmm, nothing yet. LAPS tab still shows the expiry as of 20 minutes ago but still no name or password..

Edited April 20, 2023 by Garacesh

[Garacesh]

Hmm, digging through that article it mandates setting setting the Configure password backup directory to back up the password to Active Directory. GPO.

Except that GPO doesn't exist, at least not in the Administrative Templates section of the Compliance Policy in InTune, which makes me assume if you set it via InTune it's going to decide for you to save to Azure. Which would make sense.

Except when I go to Local administrator password recovery (Preview) for a device that the Device assignment status says has successfully applied, I get this popup

[mrbios]

Based on you having "Enable local admin password management: Enabled" that's part of the old legacy laps policies. That policy doesn't exist in the new laps policies. Old Laps is under administrative templates > laps, new laps is under administrative templates > system > laps. No idea how that should look in InTune but presumably that's where your issue is?

[Garacesh]

Based on you having "Enable local admin password management: Enabled" that's part of the old legacy laps policies. That policy doesn't exist in the new laps policies. Old Laps is under administrative templates > laps, new laps is under administrative templates > system > laps. No idea how that should look in InTune but presumably that's where your issue is?

 

Yep, probably should've come and updated this thread, oops. That was the issue.

(Also, we're not hybrid enough to be hybrid, apparently, so despite running Azure AD Connect, having a DC in Azure, etc we can only back up to local AD)

 

InTune still has the old policies, by the look of it.

[DalekSec]

Managed to get it working with AAD via this guide: https://www.thelazyadministrator.com/2023/04/22/windows-laps-management-configuration-and-troubleshooting-using-microsoft-intune/

 

No on site AD/GP here so unable to test that.

[Garacesh]

Whoops,

Defender is now telling me I need to enable LAPS on the machines

 

Option 1 - Set the following Group Policy:

Computer Configuration\Policies\Administrative Templates\LAPS\Enable Local Admin Password Management

To the following value: Enable

 

Bit of an own-goal there, Microsoft!

[jslate1980]

I am having an issue with Active directory delegated accounts being able to access the password.

Domain admins work and I ran both delegated commands of Set-LapsADResetPasswordPermission and Set-LapsADReadPasswordPermission to give permission to the delegated group on the correct OU.

[jslate1980]

I am having an issue with Active directory delegated accounts being able to access the password.

[ATTACH=CONFIG]68740[/ATTACH]

Domain admins work and I ran both delegated commands of Set-LapsADResetPasswordPermission and Set-LapsADReadPasswordPermission to give permission to the delegated group on the correct OU.

 

Figured this out, if set to store in active directory, by default the password is stored and encrypted to AD, but only domain admins can decrypt the password. Unless you set a specific SID or group in group policy with - Configure authorized password decryptors.

[mrbios]

I am having an issue with Active directory delegated accounts being able to access the password.

[ATTACH=CONFIG]68740[/ATTACH]

Domain admins work and I ran both delegated commands of Set-LapsADResetPasswordPermission and Set-LapsADReadPasswordPermission to give permission to the delegated group on the correct OU.

 

There's a group policy called:

Configure authorized password decryptors

 

Add domain\lapsadmingroupname to that policy.

 

Personally I'm using Lithnet Access Manager, so rather than issuing any users as laps admins, i issued the ams service account (which is a gMSA account) access as a decryptor, and just give users access to the AMS service (linked to azure ad for auth + MFA) highly recommend it as a solution. Does mean you can't access LAPS passwords through the AD tab still, but it's much easier through the web interface of AMS....handy when you're out and about and need to pull up a laps password via your phone for something. (rare but, you never know)

[robyholmes]

I'm just trying to get me head around this one. Can anyone confirm the following for me?

 

We currently have Legacy LAPs enabled, so I need to disable this first (Ideally targeting machines with the April 2023 update? So machines which haven't yet updated continue to use legacy until they do.

 

If I backup to ADD (Intune), which we have AD Connect syncing too and devices are hybrid joined too. Can we view local admin passwords in AD as well as Intune? Or just Intune?

[jslate1980]

The information from Microsoft is a bit lacking at the moment. I haven’t seen any information on a hybrid environment. How’s your new job going?

[Koldov]

Does this work on LTSB machines...?

 

I configured this last week and 99% of my machines have converted and stored a password in AD.

 

However I noticed a few missing and it appears they are the 1% of machines still on LTSB (the others are all on LTSC)...

 

All in the same OU, all show GPO applied with RSoP/GPResult, all have the correct local admin account, all have the correct registry entries.

 

I know it's half 3 on a Friday, but I'm not getting any sense out of the internet...

[Norphy]

Windows LAPS was integrated into the April patch for Windows 10 21H1 and above, so I would imagine that LTSC 21H2 will get it as well. I don't think they'd backport it for 1809 as that's out of support for the CBB and has only got a year left of mainstream support for the LTSC. See here:

 

https://learn.microsoft.com/en-us/windows/release-health/release-information

 

LTSB is well out of mainstream support now, so it's only getting security patches and not new features. I'd get those workstations updated if I were you.

Edited May 15, 2023 by Norphy

[Koldov]

Windows LAPS was integrated into the April patch for Windows 10 21H1 and above, so I would imagine that LTSC 21H2 will get it as well. I don't think they'd backport it for 1809 as that's out of support for the CBB and has only got a year left of mainstream support for the LTSC.

 

Yeah thanks, but that's the thing... all the LTSC machines we have are Windows 10 Enterprise 2019 (1809) and have all had the April update and once I'd uninstalled the Legacy LAPS, they pinged up their 'new' LAPS passwords into AD no problem.

 

LTSB is well out of mainstream support now, so it's only getting security patches and not new features. I'd get those workstations updated if I were you.

 

I always look at extended support dates as the whole reason for using LTSB/LTSC is not to have new 'features' anyway... I was quite happy with Legacy LAPS and only moved over onto the new version because it actually broke (even though I thought I would be OK as they were all installed years ago and going by the slightly confusing information that seemed to say it would only break if Legacy LAPS was installed after the April update)...

 

http://www.edugeek.net/forums/windows-10/232440-local-admin-password-solution-now-built.html#post1992776

 

Not sure if I can run the two side by side somehow as I have about 10 laptops that I now can't get the local admin password for!

 

Although, I am working on prising those laptops out of the teachers hands, some of them are being surprisingly stubborn (like they can't teach for a day without a laptop)... Going to have start heavily implying they will stop working soon or something...

Edited May 15, 2023 by Koldov

[Garacesh]

Not sure if I can run the two side by side somehow as I have about 10 laptops that I now can't get the local admin password for!

You cannot run them both side-by-side. Installing new LAPS bricks .msi LAPS.

ISTR articles saying if you uninstalled new LAPS, .msi LAPS would resume working. So that may be your interim solution.

[Koldov]

Sorry, now I'm completely lost... Uninstall 'New LAPS'?

 

I haven't installed it have I? I just did the April update, uninstalled 'Legacy LAPS' and removed old GPO settings, then just pushed out the new GPO settings (changed schema etc.) and that was only because 'Legacy LAPS had broken even though it was installed before the April update and no new GPOs had been set...

 

Anway, it would seem I can still use "Get-LapsADPassword -Identity "computername" -AsPlainText" to retrieve the 'Legacy Laps' password for now!

[Koldov]

Also I get that LTSB is nearing EOL (Extended End Date - Windows 10 2016 LTSB Oct 13, 2026), I'm not and will get them updated as soon as possible, I'd like to be better informed on the options but I can't find any information on what builds 'Windows LAPS' should the Microsoft Information just says:

 

 

I'm aware it specifies 'LTSC versions' but iirc MS calls them all LTSC now.

 

EDIT: Emulation mode might be a solution but it looks just as complicated and means I'd have to reinstall Legacy Laps!

 

https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-scenarios-legacy

Edited May 15, 2023 by Koldov

[koryo]

Just in case someone else comes across this - If you have completed the steps to impliment Windows LAPS, can query for the LAPS password using PowerShell but the LAPS tab doesn't appear when checking a computer object in Active Directory Users & Computers on Windows 10, you may be running an out-of-date version of the RSAT package.

 

If you uninstall Update for Microsoft Windows (KB2693643) to remove the RSAT tools currently installed, you can then install RSAT using Features On Demand instead.

 

The install / uninstall instructions for the old RSAT package here have further details (including recommending and advising on how to install the newer version using Features On Demand instead): https://www.microsoft.com/en-gb/download/details.aspx?id=45520

[Ellis8026]

Just to jump on the back of this thread, we have came from a legacy laps solution and are trying to implement the new built in version.

 

We have removed the laps msi from client machines, removed old policies and ran through the steps in this thread, extending the new schema, new gpos etc:

https://woshub.com/manage-local-administrator-passwords-with-laps/

 

Client machines are stiil seemingly using legacy laps soluition even though there is no client or gpo applied for this. The laps tab is empty id AD and when i run get-lapsadpassword "this-pc" -asplaintext it reports back the source is legacylapscleartextpassword. I have ran Get-LapsDiagnostics and can see that the client is picking up the correct gpo setting to back up a password to AD, password complexity etc etc however in the pcs AD attributes it still has the legacy ms-Mcs-AdmPwd set.

 

Im also receiving an event ID on the DC 10024 "LAPS policy is configured as disabled" and i would have expected to see an event ID of 10021 with the specified settings detailed?

 

Any and all help appreciated.

 

Thanks

[jslate1980]

Just to jump on the back of this thread, we have came from a legacy laps solution and are trying to implement the new built in version.

 

We have removed the laps msi from client machines, removed old policies and ran through the steps in this thread, extending the new schema, new gpos etc:

https://woshub.com/manage-local-administrator-passwords-with-laps/

 

Client machines are stiil seemingly using legacy laps soluition even though there is no client or gpo applied for this. The laps tab is empty id AD and when i run get-lapsadpassword "this-pc" -asplaintext it reports back the source is legacylapscleartextpassword. I have ran Get-LapsDiagnostics and can see that the client is picking up the correct gpo setting to back up a password to AD, password complexity etc etc however in the pcs AD attributes it still has the legacy ms-Mcs-AdmPwd set.

 

Im also receiving an event ID on the DC 10024 "LAPS policy is configured as disabled" and i would have expected to see an event ID of 10021 with the specified settings detailed?

 

Any and all help appreciated.

 

Thanks

 

Are you accessing AD from a domain admin account, or have you specified a specific user group for access to laps in AD through group policy?