LAPS

Windows Local Administrator Password Solution (LAPS) manages and rotates per-device local administrator passwords. Windows LAPS can back up passwords to Windows Server Active Directory or Microsoft Entra ID; legacy Microsoft LAPS is the separate AD-backed predecessor. The commands in this record cover Active Directory discovery and password retrieval. Reading an AD-backed password requires a principal with password-read permission, and encrypted Windows LAPS values also require an authorized decryptor. Retrieving a password does not authenticate to a device or establish that it remains current; a current local administrator credential used with remote administration can enable lateral movement.