LAPS (Local Administrator Password Solution)

LAPS (Local Administrator Password Solution) is Microsoft's tool that gives every Windows workstation and server a unique, random local admin password, rotated automatically and stored in the directory with restricted read rights. The problem it fixes is mundane. A fleet built from a golden image inherits the same local admin account, with the same password, on hundreds of machines. An attacker who takes one device pulls the hash of that password with a tool like Mimikatz and replays it everywhere without ever cracking it, the technique known as pass-the-hash. NotPetya, in June 2017, paired that kind of credential theft with Windows' own admin tools to hop from machine to machine. Microsoft released LAPS in 2015 as a separate tool, then built it into the operating system in April 2023 as Windows LAPS, with the option of storing passwords in Entra ID and encrypting them in Active Directory. The cyber questionnaire asks about it in one of two ways: "Are local admin passwords unique per machine?" or simply "Is LAPS or an equivalent deployed?" No external scan can see it. The usual evidence is a coverage rate pulled from the console or a directory extract, and a "yes" with no percentage does not say how many machines still share the old password. A partial rollout tends to leave exactly the oldest, least watched machines in their previous state. A practitioner's caveat: LAPS protects nothing once too many people can read the attribute that holds the password, and incident responders regularly find that right granted to the whole help desk, or even to every authenticated user.