Post verification LAPS client intallation

Razzi29 311 Reputation points
2022-05-12T17:45:13.283+00:00

Recently we implemented Microsoft LAPS (Local Admin Password Solution) in the enterprise. Now, we would like to figure out how we can check multiple servers to see which ones have LAPS installed and servers we potentially missed installing LAPS. Is there a third-party app or script? We do not want to go through the manual one at a time as it will be so much time.

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,084 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,717 questions
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,355 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rich Matheisen 44,696 Reputation points
    2022-05-12T19:21:39.423+00:00

    I think you'd use the Get-ADComputer cmdlet and verity that the ms-Mcs-AdmPwd property is present on the computer object.

    0 comments
  2. Gary Reynolds 9,391 Reputation points
    2022-05-15T10:33:26.677+00:00

    Hi @Razzi29

    The simplest method to check that a computer has registered a LAPS password is the query below, it will return all computer objects that don't have a LAPS password set. As this query uses the time the password was set, it can be used by a user without permissions to see the LAPS password. 

    (&(objectclass=computer)(!ms-Mcs-AdmPwdExpirationTime=*))

    Gary.

    0 comments
  3. Razzi29 311 Reputation points
    2022-05-16T15:13:24.88+00:00

    @Gary Reynolds do I run this script on a domain controller and if so, do I just run the script as posted or I need to use the Get-ADComputer with it? Thanks