Deploy Windows LAPS: AD DS pilot and permissions

Objective

Deploy Windows LAPS with AD DS backup on a pilot OU, explicit reader and decryptor roles, evidence of password backup and a tested recovery path.

Rotation is tested on the selected pilot, the stored state is updated and the effective policy remains limited to intended OUs.

Prerequisites

Inventory Windows LAPS support and any legacy LAPS settings, record the target computer OU and current delegation, and back up the pilot GPO configuration. Define the managed account, authorized readers and decryptors and how local administrative access will be recovered if processing fails.
Use these PowerShell examples in the stated administration or pilot context with appropriate rights. Replace the OU, domain, groups and pilot name before use. Schema changes, delegation, policy refresh and rotation modify state; WhatIf previews do not. Reset-LapsPassword and Invoke-LapsPolicyProcessing operate on the local machine. Protect any recovered secret.

Step-by-step procedure

Establish the baseline and scope

Inventory Windows LAPS support and any legacy LAPS settings, record the target computer OU and current delegation, and back up the pilot GPO configuration. Define the managed account, authorized readers and decryptors and how local administrative access will be recovered if processing fails.

The intended target, prior configuration and service-specific success criteria are recorded.

Prepare the AD DS backup design

This workflow stores Windows LAPS passwords in AD DS. Confirm supported patched clients, the administration module and replication health. Extend the forest schema once through the approved schema-change process, and grant computer self-write permission on the pilot OU. An Entra-only backup design uses another workflow and does not require this AD schema preparation.

The intended AD DS directory, schema preparation and pilot computer permissions are verified.

Separate password reading from decryption

Use the real OU distinguished name and a named reader group such as CONTOSO\GG-LAPS-Readers. Grant only the required password-read rights, then audit existing extended-right holders with Find-LapsADExtendedRights. Reading encrypted attributes does not automatically authorize decryption; configure the encryption principal in policy and test with an intended reader and a non-reader.

Only intended principals can retrieve and, where required, decrypt the pilot password.

Distinguish expiration rights from local rotation

Delegate expiration-time changes to a separate operator group if the operating model requires it. The AD reset permission changes the stored expiration time; it is different from Reset-LapsPassword, which rotates the password locally on the machine where that command runs. Keep these scopes explicit and do not execute a local reset on the administration workstation by mistake.

Directory expiration delegation and local password rotation have separate roles and targets.

Apply one Windows LAPS policy to a pilot OU

Link the pilot GPO only to the selected computer OU and set BackupDirectory to AD DS, value 2. Define password settings and the intended managed account. Encryption requires a suitable domain functional level; choose authorized decryptors explicitly. A custom account must exist unless a supported automatic-account-management configuration provisions it. Check Central Store templates and policy precedence.

The pilot has the intended effective policy and managed account before rollout.

Process policy on the selected pilot

Refresh policy and invoke LAPS processing on the selected pilot with appropriate rights. These actions change system state and policy refresh may request sign-out or restart. Review the LAPS operational log for backup and local-account results, including events 10018 and 10020 when relevant. A successful processing request alone does not prove that a usable secret was backed up.

The selected pilot has a current backed-up password and no unexplained processing failure.

Test retrieval without exposing the secret

From a protected administration session, query the pilot computer as an authorized operator. Avoid plaintext output in transcripts, tickets and shared terminals; use -AsPlainText only for the controlled recovery check. Verify the intended decryptor can retrieve the secret, then rotate it on the pilot and verify the new stored state. Never copy an example password into a deployment.

Recovery access and post-test rotation are verified without retaining a plaintext password in evidence.

Expand only after recovery and permissions pass

Check several processing cycles and a controlled recovery test before adding OUs in waves. Monitor missing or stale backups, LAPS events and effective reader/decryptor rights. Document migration from legacy Microsoft LAPS and avoid competing policies. Stopping the pilot policy does not restore an earlier password; retain an approved recovery method and never try to remove the schema extension.

Each wave has recent backup evidence, defined recovery access and a measured stop criterion.

Validate the complete service

Pilot events and AD evidence show current password backup and successful local-account processing. Record the full acceptance results below before extending the change.

Intended readers/decryptors recover the secret; an unprivileged non-reader cannot.
Rotation is tested on the selected pilot, the stored state is updated and the effective policy remains limited to intended OUs.

Examples, targets and evidence limits

Use these PowerShell examples in the stated administration or pilot context with appropriate rights. Replace the OU, domain, groups and pilot name before use. Schema changes, delegation, policy refresh and rotation modify state; WhatIf previews do not. Reset-LapsPassword and Invoke-LapsPolicyProcessing operate on the local machine. Protect any recovered secret.

Observe available Windows LAPS commands

Get-Command -Module LAPS | Sort-Object Name

Observe the local operating-system build

Get-ComputerInfo | Select-Object WindowsProductName,WindowsVersion,OsBuildNumber

Preview the forest schema extension without applying it

Update-LapsADSchema -WhatIf

State-changing forest operation: extend the Windows LAPS schema after approval and preparation

Update-LapsADSchema -Verbose

Preview the pilot OU self-write delegation

Set-LapsADComputerSelfPermission -Identity "OU=Pilote-LAPS,OU=Postes,DC=contoso,DC=local" -WhatIf

State-changing directory operation: apply the intended pilot self-write delegation

Set-LapsADComputerSelfPermission -Identity "OU=Pilote-LAPS,OU=Postes,DC=contoso,DC=local"

State-changing directory operation: delegate password reading to the named group

Set-LapsADReadPasswordPermission -Identity "OU=Pilote-LAPS,OU=Postes,DC=contoso,DC=local" -AllowedPrincipals "CONTOSO\GG-LAPS-Readers"

State-changing directory delegation followed by a read-only extended-rights audit

Set-LapsADResetPasswordPermission -Identity "OU=Pilote-LAPS,OU=Postes,DC=contoso,DC=local" -AllowedPrincipals "CONTOSO\GG-LAPS-Operators"
Find-LapsADExtendedRights -Identity "OU=Pilote-LAPS,OU=Postes,DC=contoso,DC=local"

State-changing action on the pilot: refresh Group Policy; review any restart or sign-out request

gpupdate /force

State-changing processing on the selected pilot; this is not a remote target selector

Invoke-LapsPolicyProcessing

Observe recent LAPS operational events on the selected computer

Get-WinEvent -LogName "Microsoft-Windows-LAPS/Operational" -MaxEvents 30 | Select-Object TimeCreated,Id,LevelDisplayName,Message

Read protected pilot password metadata as an authorized operator

Get-LapsADPassword -Identity "PC-LAPS-01"

Sensitive read: display a password only in the controlled recovery session, without transcripts

Get-LapsADPassword -Identity "PC-LAPS-01" -AsPlainText

State-changing local operation: rotate on the selected pilot only

Reset-LapsPassword

Process policy on the selected pilot and confirm the post-rotation stored state

Invoke-LapsPolicyProcessing

Validation

The procedure is validated when:

Pilot events and AD evidence show current password backup and successful local-account processing.
Intended readers/decryptors recover the secret; an unprivileged non-reader cannot.
Rotation is tested on the selected pilot, the stored state is updated and the effective policy remains limited to intended OUs.

Rollback

Stop or unlink the pilot policy under the migration plan while preserving a known recovery route and any needed stored password.
Review introduced OU delegations against the recorded ACLs before removing them; do not revoke the only recovery operator prematurely.
Do not try to reverse the schema extension or restore an old local password; policy rollback does not undo password rotation.

Troubleshooting / common errors

No backed-up secret: check effective BackupDirectory policy, managed account, OU ACLs, replication and LAPS operational events.
Reader cannot decrypt: distinguish read permission from the configured encryption principal and confirm the object OU.
Rotation happens on an unexpected computer: stop and verify local versus directory-command scope before repeating any state-changing action.

Official references

Keep the previous state, chosen targets, diagnostic times and observed outcome with the change record.