2. Domain permission

Permissions

The user account who uses the tool needs the following permissions:

• Read LAPS password attribute(s).
• Decrypt the Windows LAPS password.
• [Optional:] Change expiration time attribute.

Caution

As always when granting permissions, you should be careful who you grant them to. You should grant permissions only to those who need them (e.g., use administration tiering).

Note

For more information please read the docs provided by Microsoft:

• Windows LAPS permission concept
• Windows LAPS attributes and rights
• Windows LAPS decryption principal
• Microsoft LAPS attribute permissions

Configuration

Ask your domain administrator to configure the permission for you. In general, if your company uses LAPS, they are already configured in the domain.