Skip to content
MitoMito Docs

AD-SCH-05: LAPS should be installed in Active Directory
ID AD-SCH-05
Severity Medium
Suite Active Directory (on-premises)
Product Active Directory
Feature Schema
Security area Privileged access
Resource type Tenant
User impact of fixing Low
Effort to fix Medium
Framework controls nist-800-53-r5:IA-5 Authenticator Management
nist-800-53-r5:AC-6(2) Least Privilege | Non-privileged Access for Nonsecurity Functions
MITRE ATT&CK T1078.003, T1550.002
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”

The Local Administrator Password Solution (LAPS) is a critical security tool that:

  • Manages local admin passwords: Automatically rotates passwords on domain-joined computers
  • Prevents lateral movement: Eliminates shared local administrator passwords
  • Secure storage: Stores passwords securely in Active Directory attributes
  • Access control: Controls who can retrieve local administrator passwords
  • Audit trail: Logs password access for compliance

Without LAPS, organizations commonly face these risks:

  • Pass-the-hash attacks: Attackers use shared local credentials to move laterally
  • Persistent access: Compromised local accounts provide ongoing access
  • Credential stuffing: Shared passwords reused across multiple systems
  • Compliance failures: Many frameworks require unique local admin passwords

Control Type

Section titled “Control Type”

Preventive

Security Recommendation

Section titled “Security Recommendation”

Deploy LAPS across your entire domain:

  1. Install LAPS: Download from Microsoft and extend the AD schema
  2. Group Policy: Configure password rotation policies (recommended: every 30 days)
  3. Access controls: Limit who can read the ms-Mcs-AdmPwd attribute
  4. Monitoring: Alert on password retrieval events
  5. Legacy LAPS: Consider upgrading to Windows LAPS (built into Windows 11/Server 2022)

How the Test Works

Section titled “How the Test Works”

This test checks for the presence of LAPS schema attributes (ms-Mcs-AdmPwd) to determine if LAPS has been installed and configured in the Active Directory environment.

Section titled “Related Tests”
  • Test-MtAdComputerUnconstrainedDelegationCount - Check for delegation risks
  • Test-MtAdUserPasswordNeverExpiresCount - Identify password policy gaps
  • Test-MtAdPasswordComplexityRequired - Verify password policies

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.