ADGPO-023: Configuración de LAPS mediante GPO
- Plataforma
- Active Directory
- Categoría
- AD Group Policy
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
La solución de contraseñas de administrador local (LAPS) proporciona la rotación automatizada de las contraseñas de administrador local en los sistemas unidos al dominio, lo que evita el movimiento lateral mediante credenciales de administrador local compartidas. LAPS debe desplegarse mediante GPO para ser efectiva, y sus configuraciones determinan la complejidad de la contraseña, la frecuencia de rotación y qué cuenta se gestiona
Por qué importa
A shared local Administrator password is the single most reliable lateral-movement primitive in an Active Directory environment. An attacker who dumps the local SAM on one workstation (Mimikatz sekurlsa::logonpasswords, or simply lsadump::sam) recovers the local Administrator NT hash, then pass-the-hashes to every other workstation that shares the password. From a single user-tier compromise this typically yields domain-wide workstation control in minutes, and from there the path to a Tier-0 credential (cached domain admin, unconstrained delegation host, service account on a server) is short. LAPS breaks this chain by giving every host a unique, randomly generated local Administrator password rotated on a fixed cadence. The protection only holds when four conditions are all true: the CSE is installed on every targeted host, a GPO with the correct settings is linked and in scope, the password actually rotates (the expiration attribute is populated and in the future), and the read ACL on ms-Mcs-AdmPwd or msLAPS-Password is restricted to Tier-0 break-glass principals plus the SELF principal that needs write rights. Common failure modes that ADGPO-023 catches: the GPO is configured but the CSE was never deployed, so passwords never rotate; the policy is enabled only on a subset of OUs and the remaining hosts still share a baseline image password; PasswordComplexity is set to 3 (no specials) or PasswordLength is left at the default 14; PasswordAgeDays is set to 365 making the credential effectively static; DoNotAllowPwdExpirationTimeProtection is enabled, which lets a compromised principal block rotation by manipulating the expiration attribute; the policy points at AdministratorAccountName = Administrator but the host was renamed during build; encryption (Windows LAPS) is disabled so the password sits in clear in AD and is replicated to every DC in clear; or the GPO covers Domain Controllers, which is unsupported and causes DC password churn.
Ruta de ataque
1. Discovery: with any domain-authenticated context, the attacker enumerates LAPS posture. Get-ADComputer -Filter * -Properties ms-Mcs-AdmPwdExpirationTime, msLAPS-PasswordExpirationTime returns the list of hosts. Any computer with a null expiration attribute is either out of scope or has a broken CSE, and is a prime target for SAM-based lateral movement. 2. Read-rights enumeration: Get-LapsADPassword (Windows LAPS) or Get-AdmPwdPassword (legacy) returns the cleartext password for every host the current principal can read. PowerView Get-DomainObjectAcl -SearchBase "DC=corp,DC=contoso,DC=com" filtered for ms-Mcs-AdmPwd or msLAPS-Password identifies which principals have ReadProperty and ExtendedRight ControlAccess. Over-broad delegation (Authenticated Users, Domain Users, a helpdesk group with thousands of members) immediately yields cleartext local admin on every host. 3. Targeting hosts that LAPS does not cover: the attacker filters Get-ADComputer for null msLAPS-PasswordExpirationTime, intersects with LastLogonTimestamp within 30 days, and gets a list of live machines that share the build-image local admin password. A single SAM dump on one of them yields the shared hash. 4. Targeting hosts where rotation broke: msLAPS-PasswordExpirationTime in the past indicates the CSE is no longer running. The current password is whatever was last set, often months old, and may already be known to a prior helpdesk turnover. The attacker uses Get-LapsADPassword to retrieve it (if delegated) or dumps SAM after a foothold. 5. Expiration-attribute abuse: if DoNotAllowPwdExpirationTimeProtection is 0 (recommended) the attacker who controls a host cannot push rotation forever, but if the policy disables that protection the attacker writes a far-future value into msLAPS-PasswordExpirationTime to freeze rotation indefinitely while they keep using the known password. 6. Backdoor account: if AdministratorAccountName points at a custom account, the attacker can create a same-named local account on a host they control and exfiltrate the LAPS-managed credential for that account. They can also enumerate which custom account is being managed and target it specifically. 7. Clear text in AD (legacy): without Windows LAPS encryption, ms-Mcs-AdmPwd is a confidential attribute but is stored in cleartext on every DC. An attacker with DCSync (Replicating Directory Changes All) or with NTDS.dit access pulls every local admin password in the domain in one operation.
Cómo lo evalúa Guerrilla
Guerrilla imports the GroupPolicy, ActiveDirectory, and (where available) LAPS PowerShell modules. It calls Get-GPO -All -Domain $env:USERDNSDOMAIN, then for each GPO calls Get-GPOReport -Guid $gpo.Id -ReportType Xml and parses the result with [xml] cast. It searches GPO.Computer.ExtensionData.Extension for RegistrySettings (Administrative Templates) and for RegistryPreferences (GPP) whose Key matches Software\Policies\Microsoft Services\AdmPwd, Software\Microsoft\Policies\LAPS, or Software\Policies\Microsoft Windows\LAPS. For each matched setting it records GpoName, GpoId, RegistryKey, ValueName, Value, Type, and Link scope (parsed from GPO.LinksTo). The check then queries the schema with Get-ADObject -SearchBase (Get-ADRootDSE).schemaNamingContext to confirm both legacy (ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime) and Windows LAPS (msLAPS-Password, msLAPS-PasswordExpirationTime, msLAPS-EncryptedPassword, msLAPS-EncryptedPasswordHistory, msLAPS-EncryptedDSRMPassword) attributes are present. For every computer in scope it calls Get-ADComputer -Filter "OperatingSystem -notlike *Server*Domain Controller*" -Properties ms-Mcs-AdmPwdExpirationTime, msLAPS-PasswordExpirationTime, msLAPS-EncryptedPassword, OperatingSystem, LastLogonTimestamp, DistinguishedName, then computes Coverage = (computers with a future expiration attribute) / (computers in scope of a LAPS GPO), Stale = computers with an expiration attribute in the past, Missing = computers with no expiration attribute at all, and OutOfScope = computers in OUs not covered by any LAPS GPO. ACL coverage for the password attribute is read via Get-Acl AD:"CN=Computer,DC=corp..." filtered for the ms-Mcs-AdmPwd / msLAPS-Password ExtendedRight GUIDs (legacy 4c164200-20c0-11d0-a768-00aa006e0529 for ReadProperty on confidential attributes; Windows LAPS uses ControlAccessRight {0e1f7b3a-...}). Output rows include GpoName, AdmPwdEnabled, PasswordComplexity, PasswordLength, PasswordAgeDays, EncryptionEnabled, AdministratorAccountName, LinkScope, CoveragePercent, StaleCount, MissingCount, ReadPrincipals, and a Notes field enumerating each baseline deviation.
Valor recomendado
LAPS habilitada mediante GPO en todos los sistemas unidos al dominio con contraseñas de 24 caracteres y una antigüedad máxima de 30 días
Remediación
Instale la CSE de LAPS en todos los sistemas gestionados mediante la instalación de software por GPO o SCCM. Configure las opciones de GPO de LAPS: habilite la gestión de contraseñas de administrador local, establezca la complejidad de la contraseña en letras mayúsculas + letras minúsculas + números + caracteres especiales, establezca la longitud de la contraseña en 24 o más caracteres y establezca la antigüedad de la contraseña en 30 días o menos. Verifique que LAPS funcione comprobando los atributos ms-Mcs-AdmPwdExpirationTime.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, IA-5(1), CM-6
- ANSSI
- vuln_no_laps
- MITRE ATT&CK
- T1078.003, T1021