Windows LAPS: delegating password read access to a group

Windows LAPS (Local Administrator Password Solution) automatically rotates each computer's local administrator password and stores it in Active Directory. The real question is: who can read that password? If the answer is "Domain Admins", then the support team needs far broader rights than necessary just to look up a password.

Goal

• Permission to read the password is granted only to a group created for this purpose (example: LAPS-Readers).
• The permission is defined at the level of the OU that contains the relevant computers.
• Who can read the passwords is audited regularly.

Check the current state

Before changing anything, look at who can read the passwords today:

Import-Module LAPS
Find-LapsADExtendedRights -Identity "OU=Workstations,DC=example,DC=local"

If the output shows users or broad groups you didn't expect, that's the first thing to fix.

Delegate read permission

# 1) Grant the group password read permission on the OU
Set-LapsADReadPasswordPermission `
  -Identity "OU=Workstations,DC=example,DC=local" `
  -AllowedPrincipals "EXAMPLE\LAPS-Readers"

# 2) Allow computers to write their own passwords to AD (needed on initial setup)
Set-LapsADComputerSelfPermission -Identity "OU=Workstations,DC=example,DC=local"

A member of the delegated group can now read the password like this:

Get-LapsADPassword -Identity "PC-0142" -AsPlainText

Make it easy to use

The support team doesn't want to type a PowerShell command every time. A small Windows Forms UI (computer name → show / copy password / show expiry) speeds things up. The important part is that the tool doesn't carry any permissions of its own: it queries with the identity of the user running it. Someone who isn't in the group can open the tool and still won't see the password.

Auditing

• Review group membership periodically.
• Monitor password updates in the Windows LAPS event log (Applications and Services Logs > Microsoft > Windows > LAPS).
• If you want the password rotated shortly after it's read, configure LAPS post-authentication actions through policy.

Lesson

Least privilege isn't a slogan, it's a configuration task: not everyone needs to be a Domain Admin. When password access is tied to a separate role, the attack surface shrinks and the question "who can read what?" gets a clear answer.