No LAPS Deployed: One Password Owns Every Workstation

The Trap

Local administrator password uniformity across the workstation estate, caused by never deploying Microsoft LAPS or Windows LAPS at all. The organisation manages domain accounts with Fine-Grained Password Policies and monitors privileged group membership meticulously, but the built-in Administrator account on every laptop and desktop carries the password set once during imaging, sometimes years earlier.

The Default State

Windows Setup, MDT and most golden-image pipelines set a local administrator password once, embed it in an unattend.xml answer file or a task sequence variable, and that same value gets baked into every deployed image thereafter. Nobody rotates it because there is no mechanism to rotate it, and there is no per-machine record of what it currently is, because it is the same everywhere. Windows LAPS ships inbox from Windows 11 22H2 and Server 2019+ onward but requires deliberate schema extension and GPO configuration; it is never enabled by default. Legacy Microsoft LAPS is a separate MSI that was never mandatory tooling, so most estates simply skip it.

The Blast Radius

One compromised endpoint yields the local administrator hash via SAM dump, LSASS scrape, or NTDS extraction from a captured image. Because the hash is identical across the fleet, pass-the-hash against any other workstation succeeds immediately, without touching Kerberos or triggering krbtgt-related detections. An attacker who compromises a single low-privilege user’s laptop can pivot laterally to every other workstation that shares the image, harvesting cached domain admin credentials, browser tokens and service account secrets from each hop. Standard EDR baselines rarely flag local admin logons between peer workstations as anomalous, since the account is expected to have local rights, so the lateral movement blends into normal helpdesk and patching traffic until ransomware deployment or domain admin token theft surfaces the intrusion.

The Lead Mechanic Fix

Deploy Windows LAPS with the AD schema extension (Update-LapsADSchema) and enforce it via GPO under Computer Configuration > Administrative Templates > System > LAPS, setting PasswordComplexity to 4, PasswordLength to at least 20, and PasswordAgeDays to 30 or lower. Store passwords in the msLAPS-Password (or ms-Mcs-AdmPwd for legacy) attribute, restrict read access via a dedicated AD security group rather than Domain Admins, and enable PostAuthenticationActions to force logoff and password reset after every retrieval. Audit retrieval events (Event ID 4662 against the LAPS attribute) into your SIEM so every credential read is attributable to a named engineer and ticket.