LAPS Not showing password - ms-Mcs-AdmPwd not set;

Question

Hi Everyone,

i tried to installed LAPS but its not showing the password, but i am able to see and send and view password expiry

my steps :

1. install LAPS on my DC
2. Created a security group ' LAPS Admins' and given all extendded rights
3. Deployed LAPS through GPO to OU 'Domain Computers'
4. Created a GPO to OU 'Domain Computers' to enable local Admin password managment
5. Enabled Administrator Account on local machine

PS C:\Windows\system32> Import-module AdmPwd.PS
PS C:\Windows\system32> Update-AdmPwdADSchema

Operation DistinguishedName Status

---

AddSchemaAttribute cn=ms-Mcs-AdmPwdExpirationTime,CN=Schema,CN=Configuration,DC=o... EntryAlreadyExists
AddSchemaAttribute cn=ms-Mcs-AdmPwd,CN=Schema,CN=Configuration,DC=Domain... EntryAlreadyExists
ModifySchemaClass cn=computer,CN=Schema,CN=Configuration,DC=Domain,DC=c... AttributeOrValueExists

PS C:\Windows\system32> Set-AdmPwdComputerSelfPermission -OrgUnit 'Domain Computers'

Name DistinguishedName Status

---

Domain Computers OU=Domain Computers,DC=Domain,DC=co,DC=uk Delegated

PS C:\Windows\system32> Set-AdmPwdReadPasswordPermission -OrgUnit 'domain computers' -AllowedPrincipals 'LAPS Admins'

Name DistinguishedName Status

---

Domain Computers OU=Domain Computers,DC=Domain,DC=co,DC=uk Delegated

PS C:\Windows\system32> Set-AdmPwdResetPasswordPermission -OrgUnit 'domain computers' -AllowedPrincipals 'LAPS Admins'

Name DistinguishedName Status

---

Domain Computers OU=Domain Computers,DC=Domain,DC=co,DC=uk Delegated

PS C:\Windows\system32> Get-AdmPwdPassword Computer Name

ComputerName DistinguishedName Password ExpirationTimestamp

---

Computer Name CN=Computer Name,OU=Domain Computers,DC=Domain... 29/07/2020 18:22:24Thanks
Mo

Answer 1

I had this exact issue. The expiration date was updating but the password field was blank. come to find out, some of my OUs had GPO inheritance disabled. it was not applying the GPO. I had to enforce the GPO, and run GPupdate on all my machines, and now I can see the LAPs password

Answer 2

Hello,

Thank you so much for posting here.

1, It is suggested that we could kindly have a recheck of the deployment. As per the deployment, we could refer to:

https://blog.thesysadmins.co.uk/deploying-microsoft-laps-part-1.html
https://blog.thesysadmins.co.uk/deploying-microsoft-laps-part-2.html

2, LAPS UI should be run as administrator to check the password.

3, Can we see ms-Mcs-AdmPwd and ms-Mcs-AdmPwdExpirationTime on Attribute Editor tab in computer Properties, but with Value <not set>? If so, we could kindly have a check of the password settings in LAPS. We could configure the password settings more complex than the local default password policy in clients.

For any question, please feel free to contact us.

Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

Best regards,
Hannah Xiong

Answer 3

Hi Hannah

Please find attached both Attribute. I have also opned LAPS with Elevated privileges.

I have also tried power shell with Elevated privileges and password is blank.

Answer 4

Hi Hannah,

I can confirm that LAPS is installed on all the workstations.

Regards
Mo

Answer 5

HI hanna<

than you for your reply

i did run as an administrator and also run as a difrent iser and used my admin account and no luck with passwords