LAPSToolkit
Functions written in PowerShell that leverage PowerView to audit and attack Active Directory environments that have deployed Microsoft's Local Administrator Password Solution (LAPS).
It includes finding groups specifically delegated by sysadmins, finding users with "All Extended Rights" that can view passwords, and viewing all computers with LAPS enabled.
Find-LAPSDelegatedGroups
Find-AdmPwdExtendedRights
The
Find-AdmPwdExtendedRightschecks the rights on each computer with LAPS enabled for any groups with read access and users with "All Extended Rights." Users with "All Extended Rights" can read LAPS passwords and may be less protected than users in delegated groups, so this is worth checking for.
Using Get-LAPSComputers
We can use the
Get-LAPSComputersfunction to search for computers that have LAPS enabled when passwords expire, and even the randomized passwords in cleartext if our user has access.
Reference
Last updated