{"id":3531,"date":"2015-05-07T21:56:03","date_gmt":"2015-05-08T05:56:03","guid":{"rendered":"http:\/\/www.atumvirt.com\/?p=3531"},"modified":"2015-05-07T21:56:03","modified_gmt":"2015-05-08T05:56:03","slug":"managing-your-local-administrator-passwords-the-correct-way","status":"publish","type":"post","link":"https:\/\/avtempwp.azurewebsites.net\/2015\/05\/managing-your-local-administrator-passwords-the-correct-way\/","title":{"rendered":"Managing Your Local Administrator Passwords The Correct Way"},"content":{"rendered":"

Some ideas take a long time to realize.\u00a0 Unfortunately, one of those has been a good way to manage local administrator passwords.\u00a0 System admins the world round have developed scripts to randomize and change the local administrator password of their systems.\u00a0 Others ensure the local administrator password is disabled, but that approach is potentially flawed too (did you know the local admin account automatically is enabled in safe mode?).\u00a0 Group Policy Preferences offered a reprieve for a few years,but the functionality was removed last year when Microsoft determined the obfuscated password was not secure (lets be real: it was a terrible<\/em><\/strong> plan to store passwords in reversible format in a – nearly universally – publicly readable file).<\/p>\n

The solution?\u00a0 LAPS \u2013 or the Local Administrator Password Solution.\u00a0 You can acquire LAPS here<\/a>.<\/p>\n

LAPS introduces a client side extension for GPO.<\/p>\n

What can it do?<\/h1>\n
    \n
  • Randomly generate passwords that are changed on managed machines<\/li>\n
  • Effectively mitigate Pass the hash (PtH) attacks that rely on identical local account passwords<\/li>\n
  • Enforced password protection during transport using Kerberos v5<\/li>\n
  • Use ACLs to protect passwords in Active Directory<\/li>\n<\/ul>\n

    <\/h1>\n

    What can I manage with LAPS?<\/h1>\n
      \n
    • Configure password parameters such as age, complexity and length<\/li>\n
    • Force password reset on a per-machine basis<\/li>\n
    • Use ACLs within Active Directory to control the security model<\/li>\n
    • Protect against computer account deletion<\/li>\n<\/ul>\n

      How does LAPS work?<\/h1>\n
        \n
      • Checks whether the local Administrator password has expired<\/li>\n
      • Generates new password when the old password is expired or required to be changed prior to expiration<\/li>\n
      • Validates the new password against the password policy<\/li>\n
      • Reports the password to Active Directory, storing it in a confidential attribute in the computer account<\/li>\n
      • Reports the next expiration time to Active Directory, storing it in an attribute in ACtive Directory<\/li>\n
      • Changes the password of the administrator account<\/li>\n<\/ul>\n

        <\/h1>\n

        What does LAPS require?<\/h1>\n

        Active Directory:<\/strong> Windows Server 2003 Service Pack 1 or later<\/p>\n

        Managed Machines: <\/strong>Windows Server 2003 SP2 or later, Windows Server 2003 x64 SP2 or later<\/p>\n

        Management tools:<\/strong> .NET framework 4.0, Windows PowerShell 2.0 or later<\/p>\n","protected":false},"excerpt":{"rendered":"

        Some ideas take a long time to realize.\u00a0 Unfortunately, one of those has been a good way to manage local administrator passwords.\u00a0 System admins the world round have developed scripts to randomize and change the local administrator password of their systems.\u00a0 Others ensure the local administrator password is disabled, but that approach is potentially flawed […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[22,33,69,70,71,72],"tags":[],"_links":{"self":[{"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/posts\/3531"}],"collection":[{"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/comments?post=3531"}],"version-history":[{"count":0,"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/posts\/3531\/revisions"}],"wp:attachment":[{"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/media?parent=3531"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/categories?post=3531"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/tags?post=3531"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}