DEV Community

StarkMan
StarkMan

Posted on

Local Administrator Password Management: Why LAPS Alone Is Not Tier Separation

#activedirectory #privilegedaccess #laps

Local Administrator Password Management: Why LAPS Alone Is Not Tier Separation

Windows LAPS solved a real problem. Before it, the local administrator password on a fleet of workstations was frequently the same value, documented in a spreadsheet that nobody updated. Managing that password per machine removes a lateral movement path that has been used in almost every large intrusion of the last decade. It does not, by itself, prevent the same movement.

What LAPS actually delivers

LAPS stores a unique, randomly generated password for the built-in local administrator account on each managed machine, rotates it on a schedule, and records it in Active Directory or Entra ID with access control on who can read it.
The security value is real and specific. A single compromised workstation no longer yields a credential that opens every other workstation. The password is unique, rotated, and its retrieval is auditable.
The limits are equally specific. LAPS covers a local account with a known name. It does not cover:

  • Additional local accounts created by an application installer or an operator.
  • Local accounts renamed or created outside the managed scope.
  • Domain accounts cached on the machine, which continue to work offline.
  • Service accounts or scheduled tasks that hold a privileged credential in an accessible location.

Why tier separation is the next step

The tier model divides identities and systems by the assets they control. Tier 0 is the directory and its administrators, Tier 1 is servers whose compromise leads to Tier 0, and Tier 2 is user workstations. The rule that does the work is that a credential from a lower tier must never authenticate to a higher tier.
LAPS does not enforce that rule. A domain administrator who logs into a workstation with cached credentials leaves credential material on that workstation, regardless of how well the local administrator password is managed. The reverse path, a workstation credential reaching a domain controller, is what relay and credential theft attacks look for.
The controls that implement the rule are unglamorous:

  • Administrators authenticate to Tier 0 systems only from dedicated, hardened workstations, and never from a general-purpose laptop.
  • Interactive logon to domain controllers is restricted by policy to a named group.
  • Credential caching on servers is limited, and cached domain logons are cleared where the design permits.
  • Service accounts are managed accounts, not shared passwords in a configuration file.

Where LAPS still fits in the sequence

LAPS is a Tier 2 control with a large return. Deploying it is straightforward and measurable: the percentage of managed machines with a unique rotated password is a number that can be reported.
Sequence it before tier separation rather than after, because it removes the easiest path while the harder work proceeds. Then treat the two as independent controls with independent metrics.

A review that avoids false confidence

The efficient approach is to ask three questions with evidence.
Which machines have LAPS deployed, and which are exempt. An exemption list of machines where the local administrator password is still static is a list of lateral movement targets.
Which local accounts exist outside LAPS management. Compare a sample of machines against a baseline, and treat every unexpected local administrator account as a finding.
Which accounts can authenticate to Tier 0 systems from a workstation. This is the question that determines whether the tier model exists or is only documented.
LAPS answers the first question well. The other two need the policy work that LAPS was never designed to replace.

References

Top comments (0)