gMSA and LAPS Password Extraction

This catalog entry groups directory reads of managed gMSA passwords and LAPS-managed local administrator secrets with a separate privileged KDS root-key exposure path. Applicability depends on the Active Directory principal's effective read rights, the LAPS generation and encryption/backup configuration, and privileged access to the relevant domain controller or root-key object. Possessing a domain account alone does not authorize password reads; later use of recovered credentials is a separate action.