ADPWD-018: Windows LAPS frente a LAPS heredado
- Plataforma
- Active Directory
- Categoría
- AD Password & Lockout Policies
- Severidad
- Low
- Pilar de Zero Trust
- Identity (peso 1)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Windows LAPS (integrado en Windows Server 2019 y posteriores y en Windows 10/11 con la actualización de abril de 2023) ofrece mejoras respecto al LAPS heredado, incluyendo cifrado de contraseñas, historial de contraseñas y gestión de la contraseña de DSRM. Las organizaciones deben migrar del LAPS heredado a Windows LAPS para obtener funciones de seguridad mejoradas
Por qué importa
Legacy LAPS stores the local Administrator password in cleartext in the ms-Mcs-AdmPwd attribute. The only access control is the AD ACL on the attribute and a confidentiality bit (control access right) on the attribute schema. Any principal with ExtendedRight All-Extended-Rights, or the specific Control-Access-Right on the ms-Mcs-AdmPwd attribute, can read every local admin password in the OU subtree without leaving an obvious event. BloodHound surfaces this as the ReadLAPSPassword edge. There is no password history, so if an attacker reads a password before rotation they keep usable cached credentials, and they have no way to verify when a rotation occurred without re-reading the attribute. There is no DSRM management, so the Directory Services Restore Mode password on DCs remains a static, manually-set secret that is rarely rotated. Windows LAPS addresses each gap. Passwords are encrypted with DPAPI-NG using a designated principal (typically Domain Admins or a custom security group) so that even a holder of the All-Extended-Rights privilege on the computer object cannot decrypt the blob without also being a member of the encryption principal. Password history (msLAPS-EncryptedPasswordHistory) lets an incident responder roll back to a prior password if a recovery operation is in flight. Post-authentication rotation (PostAuthenticationActions) automatically resets the password after checkout, capping the window of usable exposure to a configurable number of hours rather than the rotation interval. DSRM password management closes a long-standing persistence gap on domain controllers, where DSRM credentials previously had to be set manually and were therefore static, well-known, and often reused across DCs. In practice this means a forest on Legacy LAPS has a single shared attack surface (ReadLAPSPassword on the OU) that maps cleanly to lateral movement across every managed endpoint. A forest on Windows LAPS with encryption enabled requires the attacker to compromise both the read right and the encryption principal, a meaningfully harder bar. The severity here is Low because Legacy LAPS is still a substantial improvement over no LAPS at all, but the migration is a no-cost hardening step on supported OS versions and should not be deferred.
Ruta de ataque
1. Reconnaissance: the attacker enumerates the schema with PowerView (Get-DomainObject -SearchBase "CN=Schema,CN=Configuration,DC=...") or with ldapsearch to identify which LAPS attribute set is present and therefore which exploitation path applies. 2. Legacy LAPS branch: the attacker runs BloodHound with SharpHound -CollectionMethod All. The ReadLAPSPassword edge is emitted for every principal that holds the Control-Access-Right on ms-Mcs-AdmPwd for an OU. The Cypher query MATCH p=(u:User {owned:true})-[:ReadLAPSPassword|MemberOf*1..]->(c:Computer) RETURN p enumerates every reachable local admin password. 3. Bulk extraction (Legacy LAPS): with any qualifying principal the attacker dumps the entire population in one LDAP call: Get-ADComputer -Filter * -Properties ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime | Where-Object { $_."ms-Mcs-AdmPwd" } | Select-Object Name, @{n="Pwd";e={$_."ms-Mcs-AdmPwd"}} Or with LAPSToolkit Get-LAPSComputers. The attacker now has cleartext local admin for the OU and can pivot at will via SMB, WMI, or WinRM. 4. Windows LAPS branch without encryption (msLAPS-Password populated): identical to the Legacy LAPS branch above, only the attribute name changes. Get-LapsADPassword -Identity <computer> -AsPlainText returns the cleartext. 5. Windows LAPS branch with encryption (msLAPS-EncryptedPassword): the attacker must compromise a principal that is both (a) authorized to read the encrypted attribute and (b) a member of the encryption principal listed in ADPasswordEncryptionPrincipal. Without (b), DPAPI-NG returns NTE_PERM and the blob is unusable. This is the design goal of Windows LAPS encryption. 6. DSRM persistence on DCs (Legacy LAPS only, since Legacy LAPS cannot manage DSRM): the attacker who reaches a DC sets a known DSRM password with ntdsutil, reboots the DC into DSRM via bcdedit /set safeboot dsrepair, and uses DSRM credentials for persistent NTLM logon to the DC via the well-documented DsrmAdminLogonBehavior=2 registry override. Windows LAPS msLAPS-EncryptedDSRMPassword + rotation eliminates this persistence avenue when correctly configured. 7. Detection evasion: in all branches the attacker reads the attribute over LDAP, which historically did not log per-attribute access unless SACL auditing was specifically configured on the attribute. Windows LAPS event channel (Microsoft-Windows-LAPS/Operational) emits Event ID 10004 on every password retrieval, which is the recommended hunting telemetry once migrated.
Cómo lo evalúa Guerrilla
Guerrilla performs three passes: 1. Schema inspection. The check reads CN=Schema,CN=Configuration,<forest root> via System.DirectoryServices and looks up each attributeSchema object by lDAPDisplayName: ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime, msLAPS-Password, msLAPS-EncryptedPassword, msLAPS-EncryptedPasswordHistory, msLAPS-EncryptedDSRMPassword, msLAPS-EncryptedDSRMPasswordHistory, msLAPS-PasswordExpirationTime, msLAPS-CurrentPasswordVersion. Presence and the attributeSecurityGUID determine which deployment is in scope. 2. Population sampling. For every enabled computer the check requests the LAPS attributes for which the calling principal has read rights and counts the distribution: how many objects store data in ms-Mcs-AdmPwd, how many in msLAPS-Password, how many in msLAPS-EncryptedPassword, how many in none. Objects with no LAPS data are reported separately because they indicate either unmanaged endpoints or a CSE failure. 3. GPO and CSE verification. On a configurable sample of online endpoints the check reads HKLM\Software\Microsoft\Policies\LAPS and HKLM\Software\Policies\Microsoft Services\AdmPwd (remote registry via WinRM) and inspects %ProgramFiles%\LAPS\CSE\AdmPwd.dll. The result distinguishes "Windows LAPS in-box CSE only" (target state), "Legacy LAPS MSI CSE only" (Legacy LAPS deployment), and "both installed" (migration in flight or unsupported overlap). The check uses System.DirectoryServices.Protocols for the schema and population queries (single paged search per attribute) and PSRemoting for the CSE check. It does not attempt to decrypt any msLAPS-EncryptedPassword blob; presence and ACL inspection are sufficient.
Valor recomendado
Windows LAPS implementado con el cifrado de contraseñas habilitado. Migración del LAPS heredado completada
Remediación
Verifique qué versión de LAPS está implementada comprobando la presencia del atributo msLAPS-Password (Windows LAPS) frente a ms-Mcs-AdmPwd (LAPS heredado). Planifique la migración a Windows LAPS. Actualice el esquema de Active Directory para los atributos de Windows LAPS. Implemente los parámetros de GPO de Windows LAPS con el cifrado habilitado. Retire los componentes del LAPS heredado tras la migración
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(1), SC-28
- CIS AD Benchmark
- 5.7.3
- MITRE ATT&CK
- T1078.003