ADPWD-018: Windows LAPS vs Legacy LAPS
- Plataforma
- Active Directory
- Categoría
- AD Password & Lockout Policies
- Severidad
- Low
- Pilar de Zero Trust
- Identity (peso 1)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check enumerates the AD schema partition for the presence of each LAPS attribute set and reports the deployment posture for the forest: Legacy LAPS attributes (CN=Schema,CN=Configuration,DC=...): - ms-Mcs-AdmPwd (cleartext local admin password) - ms-Mcs-AdmPwdExpirationTime (next rotation FILETIME) Windows LAPS attributes (added by Update-LapsADSchema): - msLAPS-Password (cleartext password, used only when encryption is disabled or unsupported) - msLAPS-EncryptedPassword (DPAPI-NG protected blob, default in supported forests) - msLAPS-EncryptedPasswordHistory (rolling history of prior encrypted passwords) - msLAPS-EncryptedDSRMPassword (DC Directory Services Restore Mode password) - msLAPS-EncryptedDSRMPasswordHistory - msLAPS-PasswordExpirationTime - msLAPS-CurrentPasswordVersion For each managed computer the check queries which attribute is populated (Legacy, Windows-cleartext, Windows-encrypted), the age and expiration of the stored secret, and whether the password history attribute holds entries. It also reads the LAPS-relevant GPO settings under HKLM\Software\Microsoft\Policies\LAPS (Windows LAPS) and HKLM\Software\Policies\Microsoft Services\AdmPwd (Legacy LAPS) on a sample of managed endpoints to confirm BackupDirectory, PasswordComplexity, PasswordLength, PasswordAgeDays, ADPasswordEncryptionEnabled, ADPasswordEncryptionPrincipal, and PasswordHistorySize. A finding is emitted when: - The schema only contains ms-Mcs-AdmPwd / ms-Mcs-AdmPwdExpirationTime (Legacy LAPS only). - The schema contains both attribute sets but a non-trivial number of computers still store passwords in ms-Mcs-AdmPwd. - The schema contains Windows LAPS attributes but ADPasswordEncryptionEnabled is unset or 0, so passwords are written to msLAPS-Password in cleartext rather than msLAPS-EncryptedPassword. - Computers report a populated msLAPS-Password and an empty msLAPS-EncryptedPassword while the forest functional level and the DC OS support encryption (a misconfiguration, not a downlevel constraint). - The Legacy LAPS CSE (AdmPwd.dll) is still installed alongside the Windows LAPS in-box CSE, which is unsupported and can produce conflicting rotations.
Por qué importa
Legacy LAPS stores the local Administrator password in cleartext in the ms-Mcs-AdmPwd attribute. The only access control is the AD ACL on the attribute and a confidentiality bit (control access right) on the attribute schema. Any principal with ExtendedRight All-Extended-Rights, or the specific Control-Access-Right on the ms-Mcs-AdmPwd attribute, can read every local admin password in the OU subtree without leaving an obvious event. BloodHound surfaces this as the ReadLAPSPassword edge. There is no password history, so if an attacker reads a password before rotation they keep usable cached credentials, and they have no way to verify when a rotation occurred without re-reading the attribute. There is no DSRM management, so the Directory Services Restore Mode password on DCs remains a static, manually-set secret that is rarely rotated. Windows LAPS addresses each gap. Passwords are encrypted with DPAPI-NG using a designated principal (typically Domain Admins or a custom security group) so that even a holder of the All-Extended-Rights privilege on the computer object cannot decrypt the blob without also being a member of the encryption principal. Password history (msLAPS-EncryptedPasswordHistory) lets an incident responder roll back to a prior password if a recovery operation is in flight. Post-authentication rotation (PostAuthenticationActions) automatically resets the password after checkout, capping the window of usable exposure to a configurable number of hours rather than the rotation interval. DSRM password management closes a long-standing persistence gap on domain controllers, where DSRM credentials previously had to be set manually and were therefore static, well-known, and often reused across DCs. In practice this means a forest on Legacy LAPS has a single shared attack surface (ReadLAPSPassword on the OU) that maps cleanly to lateral movement across every managed endpoint. A forest on Windows LAPS with encryption enabled requires the attacker to compromise both the read right and the encryption principal, a meaningfully harder bar. The severity here is Low because Legacy LAPS is still a substantial improvement over no LAPS at all, but the migration is a no-cost hardening step on supported OS versions and should not be deferred.
Ruta de ataque
1. Reconnaissance: the attacker enumerates the schema with PowerView (Get-DomainObject -SearchBase "CN=Schema,CN=Configuration,DC=...") or with ldapsearch to identify which LAPS attribute set is present and therefore which exploitation path applies. 2. Legacy LAPS branch: the attacker runs BloodHound with SharpHound -CollectionMethod All. The ReadLAPSPassword edge is emitted for every principal that holds the Control-Access-Right on ms-Mcs-AdmPwd for an OU. The Cypher query MATCH p=(u:User {owned:true})-[:ReadLAPSPassword|MemberOf*1..]->(c:Computer) RETURN p enumerates every reachable local admin password. 3. Bulk extraction (Legacy LAPS): with any qualifying principal the attacker dumps the entire population in one LDAP call: Get-ADComputer -Filter * -Properties ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime | Where-Object { $_."ms-Mcs-AdmPwd" } | Select-Object Name, @{n="Pwd";e={$_."ms-Mcs-AdmPwd"}} Or with LAPSToolkit Get-LAPSComputers. The attacker now has cleartext local admin for the OU and can pivot at will via SMB, WMI, or WinRM. 4. Windows LAPS branch without encryption (msLAPS-Password populated): identical to the Legacy LAPS branch above, only the attribute name changes. Get-LapsADPassword -Identity <computer> -AsPlainText returns the cleartext. 5. Windows LAPS branch with encryption (msLAPS-EncryptedPassword): the attacker must compromise a principal that is both (a) authorized to read the encrypted attribute and (b) a member of the encryption principal listed in ADPasswordEncryptionPrincipal. Without (b), DPAPI-NG returns NTE_PERM and the blob is unusable. This is the design goal of Windows LAPS encryption. 6. DSRM persistence on DCs (Legacy LAPS only, since Legacy LAPS cannot manage DSRM): the attacker who reaches a DC sets a known DSRM password with ntdsutil, reboots the DC into DSRM via bcdedit /set safeboot dsrepair, and uses DSRM credentials for persistent NTLM logon to the DC via the well-documented DsrmAdminLogonBehavior=2 registry override. Windows LAPS msLAPS-EncryptedDSRMPassword + rotation eliminates this persistence avenue when correctly configured. 7. Detection evasion: in all branches the attacker reads the attribute over LDAP, which historically did not log per-attribute access unless SACL auditing was specifically configured on the attribute. Windows LAPS event channel (Microsoft-Windows-LAPS/Operational) emits Event ID 10004 on every password retrieval, which is the recommended hunting telemetry once migrated.
Cómo lo evalúa Guerrilla
Guerrilla performs three passes: 1. Schema inspection. The check reads CN=Schema,CN=Configuration,<forest root> via System.DirectoryServices and looks up each attributeSchema object by lDAPDisplayName: ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime, msLAPS-Password, msLAPS-EncryptedPassword, msLAPS-EncryptedPasswordHistory, msLAPS-EncryptedDSRMPassword, msLAPS-EncryptedDSRMPasswordHistory, msLAPS-PasswordExpirationTime, msLAPS-CurrentPasswordVersion. Presence and the attributeSecurityGUID determine which deployment is in scope. 2. Population sampling. For every enabled computer the check requests the LAPS attributes for which the calling principal has read rights and counts the distribution: how many objects store data in ms-Mcs-AdmPwd, how many in msLAPS-Password, how many in msLAPS-EncryptedPassword, how many in none. Objects with no LAPS data are reported separately because they indicate either unmanaged endpoints or a CSE failure. 3. GPO and CSE verification. On a configurable sample of online endpoints the check reads HKLM\Software\Microsoft\Policies\LAPS and HKLM\Software\Policies\Microsoft Services\AdmPwd (remote registry via WinRM) and inspects %ProgramFiles%\LAPS\CSE\AdmPwd.dll. The result distinguishes "Windows LAPS in-box CSE only" (target state), "Legacy LAPS MSI CSE only" (Legacy LAPS deployment), and "both installed" (migration in flight or unsupported overlap). The check uses System.DirectoryServices.Protocols for the schema and population queries (single paged search per attribute) and PSRemoting for the CSE check. It does not attempt to decrypt any msLAPS-EncryptedPassword blob; presence and ACL inspection are sufficient.
Valor recomendado
Windows LAPS deployed with password encryption enabled. Legacy LAPS migration completed
Remediación
Verify which LAPS version is deployed by checking for the msLAPS-Password attribute (Windows LAPS) versus ms-Mcs-AdmPwd (Legacy LAPS). Plan migration to Windows LAPS. Update the AD schema for Windows LAPS attributes. Deploy Windows LAPS GPO settings with encryption enabled. Decommission legacy LAPS components after migration
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(1), SC-28
- CIS AD Benchmark
- 5.7.3
- MITRE ATT&CK
- T1078.003