Read LAPS passwords with extended rights

Delegated read of the LAPS attribute lets you pull local admin passwords for every managed machine you can see.