Active Directory Administration Cookbook

How it works...

The Local Administrator Password Solution has three components:

• The LAPS GPO instructs domain-joined devices in scope with settings.
• The LAPS Client-side Extensions set and exchange clear-text passwords with Active Directory, based on the GPO.
• The LAPS attributes for computer objects in Active Directory store passwords and expiration timeframes for LAPS. Devices have SELF permissions to write to these attributes.

Passwords for local Administrator accounts are stored in clear-text in the LAPS attributes. The Filtered Attribute Set (FAS) protects these attributes from view. By default, only members of the Enterprise Admins and Domain Admins group have access to these attributes. The FAS relies on domain controllers running ...