LAPS Not showing password - ms-Mcs-AdmPwd not set;

Hi Hannah,

I have also tried the power shell as administrator and got the below results

PS C:\Windows\system32> Get-AdmPwdPassword Computer Name

ComputerName DistinguishedName Password ExpirationTimestamp

Computer Name CN=Computer Name,OU=Domain Computers,DC=domain... 29/07/2020 18:22:24

Hi,

Thank you so much for your feedback.

Usually, we try to deploy LAPS according to the following steps:

1.Install LAPS.msi on one domain controller.

2.Install LAPS to all the clients via GPO and check if we install LAPS on clients..
Computer Configuration->Policies->Software Settings->Right click Software Installation and click New->Package

3.Import module AdmPwd.PS and update AdmPwdADSchema on DC.
Import-module AdmPwd.PS
Update-AdmPwdADSchema

We need to run these commands while logged in to the network as a schema admin.

4.Adding Machine Rights
We need to delegate to right to allow the computer object to write to the ms-MCS-AdmPwd and ms-Mcs-AdmPwdExpirationTime attributes.

For example, the OU is called Computers.

Set-AdmPwdComputerSelfPermission -OrgUnit "OU=Computers,DC=domain,DC=com"

5.Check ExtendedRights permissions on OU

To get information on the groups and users able to read the password (ms-MCS-AdmPwd) for a specific Organizational Unit (OU), run the following command.

Find-AdmPwdExtendedRights -identity "OU=Computers,DC=domain,DC=com" | Format-Table ExtendedRightHolders

6.Delegate a Security group the rights to view and reset LAPS

Set-AdmPwdReadPasswordPermission -OrgUnit "OU=Computers,DC=domain,DC=com"-AllowedPrincipals <users or groups>
Set-AdmPwdResetPasswordPermission -OrgUnit "OU=Computers,DC=domain,DC=com"-AllowedPrincipals <users or groups>

7.Configure GPO for LAPS.

8.Restart the clients to make the GPO take effect.

After the above steps, check whether we can view the local administrator password with PowerShell command or computer Properties or LAPS app.

1.View the local administrator password on Computer Properties:

2.Or view the local administrator password by running get-admpwdpassword ComputerName

3.View the local administrator password by LAPS app.

We could kindly have a recheck of the deployment. It is also suggested that we could run gpresult /h to check the group policy result report to see whether the specific settings get applied or not.

Best regards,
Hannah Xiong

We had this but it turned out for us you needed to run LAPS GUI as Admin, or PowerShell as Admin then the passwords displayed. Otherwise blank. Hope this helps.

Hello,

i have the exact same Issue the Password is not set yet. Everything is configured.

• "ms-Mcs-AdmPwd" shows <Nicht festgelegt/NotSet>
• "ms-Mcs-AdmPwdExpirationTime" Shows Data like 133141913278269400

Ive tryed everything to make it work.

My Laps UI started as Administrator is attached Showing no Password and wrong Expire Time. The Default is set to 5 Days.

In case you are still waiting for the right answer pertaining to the ms-Mcs-AdmPwd still says <Not Set> or it shows empty in the password field of the LAPS fat client.

Why it was empty is because your built-in .\Administrator account were still disabled by default.

Go and enable it then do a gpupdate again and reboot the workstation. Hope that works for ya ~ cheers