{"id":1649,"date":"2022-01-11T10:39:49","date_gmt":"2022-01-11T08:39:49","guid":{"rendered":"https:\/\/helia.ee\/koolitus\/?page_id=1649"},"modified":"2022-01-12T09:38:45","modified_gmt":"2022-01-12T07:38:45","slug":"windows-server-2019-how-to-set-up-and-configure-laps","status":"publish","type":"page","link":"https:\/\/helia.ee\/koolitus\/?page_id=1649","title":{"rendered":"Windows Server 2019 – How To Set Up and Configure LAPS"},"content":{"rendered":"

LAPS<\/a>\u00a0(Local Administrator Password Solution) is a free and helpful tool that Microsoft recommends for local administrator password management.<\/p>\n

Below you will find a step-by-step walkthrough to install and configure LAPS.<\/p>\n

What Is LAPS Used For?<\/h2>\n

One of the most detrimental misconfigurations on a Windows network is setting the same password for all local administrator accounts. It happens everywhere. Even if you\u2019ve streamlined your endpoint rollouts with imaging software, it\u2019s just easier to make that admin login the same across the organization. The support staff and management software can use it without needing to worry about remembering a password schema. Who else can benefit from this ease of configuration? Malicious actors, worms, viruses,\u00a0ransomware<\/a>\u00a0just to name a few.<\/p>\n

Once a password hash has been stolen, it can be used over and over again on any computer that has that same user\/password locally. A common tool for this credential stealing is\u00a0Mimikatz<\/a>, a tool that can dump passwords and other authentication methods such as kerberos tickets out of memory and use those to escalate from a normal under-privileged account to an administrator account.<\/p>\n

The primary defense against\u00a0Mimikatz<\/a>\u00a0(and other\u00a0privilege escalation<\/a>) is limiting administrative privileges to only those users that need it. That\u2019s definitely easier said than done, especially in an enterprise environment that has been around for a long time. It\u2019s common to start at a company where you find a network that was built without design or security in mind. Many times\u00a0least privilege<\/a>\u00a0wasn\u2019t a consideration when a piece of software or business function just needed to work.<\/p>\n

Luckily in 2015 Microsoft came up with an integrated solution for this. LAPS enables admins to manage the local account passwords of domain-joined computers.<\/p>\n

LAPS protects these passwords by storing them in an access-control list (ACL) within AD (Active Directory), so only users with access rights can read or request a password reset.<\/p>\n

System Requirements For Microsoft LAPS<\/h2>\n

Before you install LAPS, ensure that you meet the following prerequisites:<\/p>\n

Management Tools:<\/b><\/p>\n