LAPS Auditing, Alerts & Management Dashboard – Complete Guide (Part 3)

Posted on by
LAPS Monitoring, Alerts & Troubleshooting – Complete Guide
 Active Directory • Security • LAPS Monitoring
MAHARJAN-BINOD July 21, 2026 18 min read LAPS, Monitoring, Alerts, Troubleshooting, Event Logs

Introduction

You’ve deployed LAPS, configured the GPOs, and maybe even built a management console. But how do you know it’s actually working? How do you detect failures, track password retrievals, and ensure compliance?

This guide covers the monitoring, alerting, and troubleshooting side of LAPS – the part that keeps your deployment healthy and secure.

We’ll explore:

  • Where LAPS logs its events and what each event means.
  • How to set up proactive alerts for failures and critical events.
  • Building a simple monitoring dashboard to track LAPS health.
  • Troubleshooting the most common LAPS issues.
Audience: This guide is for IT administrators, security teams, and anyone responsible for managing LAPS in their organisation.

Why Monitor LAPS?

LAPS is a critical security control. If it fails, you could be left with:

  • Stale passwords – machines with passwords that never rotate, increasing the risk of lateral movement.
  • Lost access – helpdesk unable to retrieve passwords for emergency access.
  • Compliance violations – failure to meet password rotation requirements.
  • Security blind spots – no visibility into who is accessing LAPS passwords and when.
Security Insight: A LAPS password that never rotates is just as dangerous as a static local admin password. Monitoring ensures rotation is actually happening.

Understanding LAPS Event Logs

All LAPS operations are logged in the Applications and Services Logs under:

Microsoft → Windows → LAPS → Operational

This log exists on:

  • Domain Controllers – for password backup and retrieval events.
  • Workstations/Servers – for local password change events.

Key things to know:

  • The log is enabled by default when LAPS is installed.
  • You can view it in Event Viewer or query it with PowerShell.
  • Events are grouped by Event ID – each one tells a different story.
Important: If you’re looking for password retrieval events (who accessed the password), you must check the log on a Domain Controller. Workstations do not log retrieval events.

Complete Event ID Reference

Here’s a comprehensive table of all LAPS Event IDs, what they mean, and how to respond.

Event ID Description Severity Location What to Check
10001 Password backed up to AD successfully ✅ Success Domain Controller Normal operation – indicates a successful password rotation.
10002 Password changed on the local machine successfully ✅ Success Workstation/Server Normal operation – the local password was updated.
10003 Password backup to AD failed ❌ Error Domain Controller Check AD permissions, network connectivity, or schema extension.
10004 Password change on local machine failed ❌ Error Workstation/Server Check if the local account exists, or if the machine is offline.
10005 Password read from AD (audit) ℹ️ Audit Domain Controller This is the retrieval audit – tracks who accessed the password.
10006 Password encryption key created ℹ️ Info Domain Controller Indicates encryption is enabled and a key was generated.
10007 Password encryption key deleted ℹ️ Info Domain Controller Key was removed (e.g., during decryption).
10010 Encryption/decryption status ℹ️ Info Domain Controller Shows if encryption is enabled and working.
10020 DSRM password backed up ✅ Success Domain Controller DSRM password rotation was successful.
Pro Tip: If you’re not seeing any events, verify that:
1. The LAPS operational log exists and is enabled.
2. Your GPO is applied correctly (gpresult /r).
3. The LAPS schema extension was completed.

Setting Up LAPS Alerts

Proactive alerts help you respond to issues before they become problems. You can set up alerts for:

  • Password backup failures (Event ID 10003)
  • Password change failures (Event ID 10004)
  • Password retrievals (Event ID 10005) – for security monitoring
  • Password expirations – passwords nearing their rotation date

Alerting Methods

1. Email Alerts via Task Scheduler

Windows Task Scheduler can trigger a PowerShell script whenever a specific Event ID occurs. The script can then send an email notification.

Event triggers to monitor:

  • Event ID 10003 – Password backup failed
  • Event ID 10004 – Password change failed
  • Event ID 10005 – Password retrieval (optional)
How it works: Task Scheduler watches the LAPS operational log. When a matching Event ID occurs, it runs a PowerShell script that sends an email to your IT team.

2. Email Alerts for Password Expirations

You can also set up a scheduled task (e.g., daily) that checks AD for computers where the LAPS password is about to expire, and sends a summary report.

3. SIEM Integration

If your organisation uses a SIEM (like Splunk, QRadar, or Azure Sentinel), you can forward LAPS events to it for centralised monitoring and alerting.

Remember: Events 10001, 10002, 10003, and 10004 are logged on the machine where the password operation occurred. To capture all events, you need to collect logs from both Domain Controllers and workstations.

LAPS Monitoring Dashboard

A dashboard gives you a single pane of glass view of your LAPS environment. Here’s what a good LAPS dashboard should show:

Key Metrics

  • Total computers – overall count of managed machines.
  • Managed by LAPS – computers with LAPS password stored in AD.
  • Not managed – computers missing LAPS attributes.
  • Expired passwords – passwords past their expiry date.
  • Expiring soon – passwords expiring within 7 days.
  • Retrieval events – who accessed LAPS passwords and when.
  • Failure events – backup/change failures (Event IDs 10003, 10004).

Dashboard Types

1. PowerShell HTML Report

You can generate an HTML report with summary statistics and a breakdown by OU. This can be saved as a file or emailed to your team.

2. Active Directory Users & Computers (ADUC)

The LAPS tab in ADUC shows each computer’s password, expiration, and history. For individual machine checks, this is still the simplest option.

3. Custom Management Console

Build a small management tool (like the LAPS Management Console covered in our previous post) that pulls all data from AD and the event log.

Pro Tip: A good dashboard should alert on anomalies – not just show data. For example, highlight expired passwords in red and expiring soon in yellow.

Troubleshooting Common LAPS Issues

Here’s a step‑by‑step troubleshooting guide for the most common LAPS problems.

Issue 1: No LAPS Password is Being Set

1 Check msLAPS-PasswordExpirationTime attribute on the computer object in AD.
2 If empty, verify the LAPS GPO is applied: gpresult /r.
3 Check Event Viewer for Event ID 10003 (backup failed) on the Domain Controller.
4 Ensure the computer has permissions to write to its AD object.

Issue 2: Can’t Retrieve LAPS Password

1 Are you running as a Domain Admin or a delegated LAPS reader? Check your permissions.
2 If using encryption, confirm you’re a member of the decryptor group.
3 Check if the password exists: look at the msLAPS-Password attribute in AD.
4 If you get “elevation required”, run the retrieval command as Administrator.

Issue 3: No Retrieval Events (Event ID 10005)

1 Ensure you’re checking the Domain Controller, not a workstation.
2 Check if the LAPS operational log exists: wevtutil gl Microsoft-Windows-LAPS/Operational.
3 If the log is empty, generate a test event: Get-LapsADPassword -Identity <computer> -AsPlainText.
4 If you see “LAPS policy processing failed” instead of “Password was read from AD”, check GPO application on the DC.

Issue 4: Password Rotation Fails (Event ID 10004)

1 Check if the local administrator account exists on the machine.
2 If using a custom admin account name, ensure it matches the GPO setting.
3 Verify the machine is online and can communicate with the Domain Controller.
4 Check local policy – ensure the LAPS GPO is applied: gpresult /r.

Issue 5: “LAPS Policy Processing Failed” (Event ID 10005 with Error)

1 This indicates the LAPS client on the DC is having trouble reading its GPO.
2 Run gpupdate /force on the Domain Controller.
3 Check if the LAPS schema extension was completed: Get-ADObject -SearchBase (Get-ADRootDSE).SchemaNamingContext -Filter {Name -like "msLAPS-*"}.
4 If missing, run Update-LapsADSchema as Schema Admin.
Pro Tip: Most LAPS issues come down to one of three things: permissions, GPO application, or schema extension. Check these first.

Best Practices for LAPS Monitoring

  • Check event logs regularly – set up a weekly review of LAPS events to catch issues early.
  • Monitor password expirations – don’t wait for someone to discover they can’t log in.
  • Track retrieval events – Event ID 10005 tells you who is accessing LAPS passwords. Use it for security audits.
  • Set up alerts for failures – Event IDs 10003 and 10004 indicate something is wrong and needs attention.
  • Test retrieval regularly – verify that your helpdesk team can actually get passwords when they need them.
  • Document your LAPS setup – including OUs, GPOs, and delegated permissions. This makes troubleshooting much easier.
  • Use a management tool – a simple dashboard or console can save hours of manual checking.

Download the LAPS Management Console

To help you get started with LAPS monitoring and management, I’ve created a complete LAPS Management Console – a Windows GUI tool that combines all the features we’ve discussed in this series.

LAPS Management Console

A complete PowerShell GUI tool for LAPS management, including:
Show Password · Password History · Last Retrieval · Summary Stats · Audit Logs · Ping & Port Check · Email & Export

Save the file as LAPS-GUI.ps1 and run as Administrator.
Requires PowerShell 5.1+ with LAPS and ActiveDirectory modules.

Pro Tip: After downloading, right-click the file and select “Run with PowerShell” – or open PowerShell and run: powershell.exe -ExecutionPolicy Bypass -File "C:\Path\LAPS-GUI.ps1"

Conclusion

LAPS is a powerful security tool, but like any security control, it needs ongoing monitoring and maintenance. By understanding the event logs, setting up alerts, and following a troubleshooting workflow, you can ensure that your LAPS deployment remains healthy and secure.

Key takeaways:

  • Event IDs 10001–10005 are your primary monitoring targets.
  • Event ID 10005 (retrieval) is only logged on Domain Controllers.
  • Alerts on failures (10003, 10004) help you respond before problems escalate.
  • A simple dashboard gives you a quick view of LAPS health.
  • Most issues are solved by checking permissions, GPOs, or the schema.
Next steps: Review your LAPS event logs today. Set up at least one alert for password failures. Build a simple dashboard that shows your LAPS health at a glance.

Happy monitoring! 🔐

Post Views: 0

Leave a Reply

Your email address will not be published. Required fields are marked *