Windows LAPS rollout
Unique, rotating local admin passwords with Windows LAPS, and who is allowed to read them.
DRAFT OUTLINE. This page is a structure to fill in, not finished research.
# Lab environment
- A small home Active Directory lab (details kept general on purpose)
- [TBD: generic lab summary for this write-up: no host names, IPs or domain names]
# The problem LAPS solves
- Shared local admin passwords and lateral movement
# Lab setup
- Schema and policy setup
- [TBD: your exact steps and screenshots]
# Policy settings
- Password length, age, backup target (AD vs Entra)
- Encryption and who can decrypt
- [TBD: values you chose and why]
# Delegating read access
- Least-privilege read permissions per OU
- [TBD: your delegation model]
# Verification
- [TBD: how you confirmed rotation and access auditing]
# References
- [TBD: sources you used]