---
title: "LAPS"
description: "Microsoft LAPS is a password manager that utilizes Active Directory to manage and rotate passwords for local Administrator accounts across all of your Windows endpoints."
category: "Security Tips"
subcategory: "Security Tipps"
last_updated: "2023-04-06"
source_url: "https://docs.xeox.com/security-tips/5bjCurHWKkyKsunBs6j6JF/laps/wjrQNiMRMMFmAMfqzE33kV"
---

# LAPS

Microsoft LAPS is a password manager that uses Active Directory to manage and rotate passwords for local administrator accounts across all of your Windows endpoints.

**[How to Configure Microsoft Local Administrator Password Solution (LAPS)](https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-guide-how-to-configure-microsoft-local/ba-p/2806185)**

1. Download and Install LAPS via policies on every of your server/client devices
- msiexec.exe /i %~dp0LAPS.x64.msi CUSTOMADMINNAME=loc-admin /Qb- /L\*V "c:\\temp\\laps\_install.log"
2. Install LAPS management features (part of the LAPS Package) on the managing Server(DC)
3. Install LAPS admx files from the package and copy it to policydefinitions Update active directory schema
- Import-module AdmPwd.PS
- Update-AdmPwdADSchema

After Schema Update two new attributes come up:

![notion image](https://docs.xeox.com/media/a5825710e44ea574.png)

4. To write these two attributes, the Computer has to be granted access to these attributes: Delegate this permissions to the whole domain:
- Launch PowerShell as Domain Administrator
- Run command:Set-AdmPwdComputerSelfPermission -Identity "C=domain,DC=local"
2. Create a GPO based on LAPS GPO-Template. As a pattern you can use the following settings:

![notion image](https://docs.xeox.com/media/3e9702e33b2316e4.png)

If you want, modify the password rules and link the policy to the domain(root)(except Domaincontrollers)

**Be aware not to apply the policy to DomainControllers!**

ADD DomainControllers under Advanced settings and set Read Attribute to "Deny".

![notion image](https://docs.xeox.com/media/7729405ba60dc862.png)

![notion image](https://docs.xeox.com/media/bee137958cf69f62.png)

## Benefit of using XEOX

XEOX has a function that lets you see your LAPS password, if you have the right role assigned to your user.

With the **[Verifier in Administration](https://docs.xeox.com/administration/wyLDjDBC1xLUFoXLAzdg11/my-organisation/8XEhCiwbu1HKqH41rYFSua)** you are able to select the role to let the user see secrets, the LAPS password among other things

![notion image](https://docs.xeox.com/media/289746c00d557af4.png)

Now, if you click on a **Hardware** in **Devices** you will get an overview of information about your device.

![notion image](https://docs.xeox.com/media/904416085ed4d129.png)

Click on **Manage** - **Show Secrets** and there you will find a field that not only lets you enter a key and value, for example a password if you have trouble remembering them or if the password is needed and changed by more people, but you also see your LAPS password, if you have activated LAPS.

![notion image](https://docs.xeox.com/media/a5cf54d233687b81.png)

![notion image](https://docs.xeox.com/media/0ab8c7793ce52824.png)