{"id":3342,"date":"2020-04-05T01:34:43","date_gmt":"2020-04-05T01:34:43","guid":{"rendered":"http:\/\/pariswells.com\/blog\/?p=3342"},"modified":"2025-11-24T23:21:21","modified_gmt":"2025-11-24T23:21:21","slug":"how-to-install-and-setup-laps-local-administrator-password-solution","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/random\/how-to-install-and-setup-laps-local-administrator-password-solution","title":{"rendered":"How to install and setup LAPS ( Local Administrator Password Solution ) Agent GPO"},"content":{"rendered":"\n

For Servers 2019 and Windows 10 Use the Inbuilt Functionality https:\/\/lazyadmin.nl\/it\/windows-laps\/<\/a><\/p>\n\n\n\n

Download<\/h2>\n\n\n\n

Click here to Download the software<\/a><\/p>\n\n\n\n

Install<\/h2>\n\n\n\n

Install 32bit or 64bit depending on server , install ALL the Management Tools<\/p>\n\n\n\n

Create a new package and use the LAPS.x64.msi file that we downloaded earlier. Make sure that you add the parameter CUSTOMADMINNAME=LAPSAdmin<\/strong> in your package , this will create the LocalAdmin Account ( LAPs does not create the account for you ) Without this you will need to deploy a script to do this for you ( no way to do this via GPO due to security issues of deploying a password in GPO)<\/p>\n\n\n\n

$Username = \"LAPSAdmin\"\n\n# Create Random LAPS Password\ntry {\n    $length = 14\n    $characters = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()_+=-\"\n    \n    $password = \"\"\n    for ($i = 1; $i -le $length; $i++) {\n        $randomIndex = Get-Random -Minimum 0 -Maximum $characters.Length\n        $password += $characters[$randomIndex]\n    }\n\n    $group = \"Administrators\"\n\n    # Check if user already exists using ADSI\n    $adsi = [ADSI]\"WinNT:\/\/$env:COMPUTERNAME\"\n    $existing = $adsi.Children | Where-Object { $_.SchemaClassName -eq 'user' -and $_.Name -eq $Username }\n\n    if ($null -eq $existing) {\n        Write-Host \"Creating new local user $Username.\" -ForegroundColor Green\n        net user $Username \"$password\" \/add \/expires:never \/passwordchg:no | Out-Null\n        \n        Write-Host \"Adding local user $Username to $group group.\" -ForegroundColor Green\n        net localgroup \"$group\" $Username \/add | Out-Null\n    }\n    else {\n        Write-Host \"Setting new password for existing user $Username.\" -ForegroundColor Yellow\n        # Preferred modern way (works on Windows 10\/11\/Server 2016+)\n        $existing.SetPassword($password)\n    }\n\n    # Ensure password never expires (more reliable than WMIC)\n    Write-Host \"Ensuring password for $Username never expires and cannot be changed by user.\" -ForegroundColor Green\n    net user $Username \/expires:never | Out-Null\n    net user $Username \/passwordchg:no | Out-Null\n\n    Write-Host \"LAPS-like admin account '$Username' configured successfully.\" -ForegroundColor Cyan\n    Write-Host \"Password: $password\" -ForegroundColor Red\n}\ncatch {\n    Write-Error \"Failed: $_\"\n}<\/code><\/pre>\n\n\n\n
Setup<\/h2>\n\n\n\n
Open Powershell as Administrator and with Domain Admin Writes and run<\/p>\n\n\n\n
Import-module AdmPwd.PS  <\/strong><\/p>\n\n\n\n
Update-AdmPwdADSchema<\/strong><\/p>\n\n\n\n
Make sure the above says Success<\/p>\n\n\n\n
In the same Powershell Window you need to declare the OU’s where the computers will live<\/p>\n\n\n\n
Set-AdmPwdComputerSelfPermission -OrgUnit <name of the OU to delegate permissions><\/strong><\/p>\n\n\n\n
Now you want to see who have access to look at the password in the OU<\/p>\n\n\n\n
Find-AdmPwdExtendedrights -identity \u201cOU NAME\u201d<\/strong><\/p>\n\n\n\n
Add or remove permissions via : Set-AdmPwdReadPasswordPermission -OrgUnit <name of the OU to delegate permissions> -AllowedPrincipals <users or groups><\/strong><\/p>\n\n\n\n
Group Policy<\/h2>\n\n\n\n
On the PC you installed the LAPS tool to ,  copy the following files : <\/p>\n\n\n\n
C:\\Windows\\PolicyDefinitions\\AdmPwd.admx to ( ON a domain controller )<\/strong> C:\\Windows\\SYSVOL\\domain\\Policies\\PolicyDefinitions\\<\/p>\n\n\n\n
C:\\Windows\\PolicyDefinitions\\en-US\\AdmPwd.adml to ( ON a domain controller )<\/strong> C:\\Windows\\SYSVOL\\domain\\Policies\\PolicyDefinitions\\en-US\\AdmPwd.adml <\/p>\n\n\n\n
Now create a Group Policy and Apply to the computers you would like to have self managed local Administrator Password<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Administering<\/strong><\/p>\n\n\n\n
How to find password using Gui<\/strong><\/p>\n\n\n\n
On the PC installed with LAPS , run  : C:\\Program Files\\LAPS\\AdmPwd.UI.exe and enter the computer name to find the password<\/p>\n\n\n\n
Use Powershell : Get-AdmPwdPassword -Computername “%COMPUTERNAME%”<\/p>\n\n\n\n
To reset password Immediately :<\/strong> Reset-AdmPwdPassword -ComputerName <computername><\/p>\n","protected":false},"excerpt":{"rendered":"
For Servers 2019 and Windows 10 Use the Inbuilt Functionality https:\/\/lazyadmin.nl\/it\/windows-laps\/ Download Click here to Download the software Install Install 32bit or 64bit depending on server , […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[1103,970,2493,2494,2495,627],"class_list":["post-3342","post","type-post","status-publish","format-standard","hentry","category-random","tag-download","tag-install","tag-laps","tag-local-admin","tag-local-administrator-password-solution","tag-reset"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t