How to Implement LAPS on Windows Server 2025

Introduction

The Local Administrator Password Solution (LAPS) is a Microsoft solution that addresses the critical security challenge of managing local administrator passwords on domain-joined computers. With LAPS, you can automatically manage and rotate local admin passwords, store them securely in Active Directory, and control access using standard AD permissions.

Windows Server 2025 brings the new Windows LAPS (built‑in) as a native feature, replacing the legacy MSI‑based LAPS. This guide walks you through the entire implementation process on a Windows Server 2025 Active Directory domain controller.

Windows LAPS Overview

Figure 1: Windows LAPS overview in Server Manager on Windows Server 2025.

Prerequisites

Before you begin, ensure your environment meets the following requirements:

• Windows Server 2025 with the AD DS role installed.
• Active Directory domain functional level at least Windows Server 2016.
• Schema Admin and Domain Admin privileges (for schema extension and GPO configuration).
• Windows 11 / Windows Server 2025 client machines (for the LAPS client component).
• PowerShell 5.1 or later (comes pre‑installed).
• Network connectivity between domain controllers and clients.

AD DS Role Check

(Server Manager → AD DS)

Figure 2: Verify AD DS role and domain functional level before LAPS deployment.

Windows LAPS requires additional attributes in the AD schema to store password metadata. The schema extension is a one‑time operation that must be performed by a Schema Admin.

Run the following PowerShell command on the schema master DC:

AD Schema Extension (PowerShell)

(PowerShell as Schema Admin)

Figure 3: Running Update-LapsADSchema to extend the AD schema for Windows LAPS.

LAPS settings are managed through Group Policy. You need to define password complexity, rotation frequency, and which accounts to manage.

1. Open Group Policy Management Console (GPMC).
2. Create a new GPO (e.g., Windows LAPS – Settings) or edit an existing one.
3. Navigate to:
   Computer Configuration → Policies → Administrative Templates → System → LAPS
4. Configure the following policies:

Group Policy LAPS Settings

(GPMC → Administrative Templates → LAPS)

Figure 4: Configuring LAPS Group Policy settings in the GPMC on Windows Server 2025.

To allow LAPS to write and read password data, you need to set appropriate permissions on the AD computer objects. This is done using PowerShell.

Use the following command to set the required permissions:

To grant read access to a specific group (e.g., LAPS_Readers):

Setting AD Permissions

(PowerShell as Domain Admin)

Figure 5: Setting AD permissions for LAPS using Set-LapsADComputerSelfPermission and Set-LapsADReadPasswordPermission.

Once the server‑side configuration is complete, you need to deploy the LAPS client component to your domain‑joined machines. On Windows 11 and Windows Server 2025, the LAPS client is built‑in and enabled via Group Policy.

Client‑Side Configuration

The LAPS client is automatically activated when the GPO settings are applied. Ensure the GPO is linked to the OUs containing your workstations and servers.

Managing LAPS with PowerShell

View the LAPS password for a specific computer:

Managing LAPS with PowerShell

(PowerShell cmdlets)

Figure 6: Managing LAPS with PowerShell cmdlets – retrieve passwords.

Conclusion

Implementing LAPS on Windows Server 2025 is a straightforward process that significantly enhances your Active Directory security posture. By following this step‑by‑step guide, you have:

• Extended the AD schema with LAPS attributes.
• Configured Group Policy to enforce password complexity and rotation.
• Set appropriate AD permissions for secure password storage and retrieval.
• Deployed LAPS to clients and learned key management PowerShell commands.

With LAPS in place, you have eliminated the risk of static local admin passwords across your entire Windows fleet. Your systems are now more resilient against lateral movement and credential theft attacks.

Happy securing! 🚀