Functions written inthat leverage to and attack environments that have deployed Microsoft’s Local Administrator Password Solution (LAPS). It includes finding groups specifically delegated by sysadmins, finding users with “All Extended Rights” that can view passwords, and viewing all computers with LAPS enabled.
Please submit issues or comments for any problems or performance improvements. This project was created with code from an older version of PowerView.
For more information on how LAPS works see.
and may be less protected than the users in the delegated groups. An example is the user which adds a computer to the domain automatically receives the “All Extended Rights” permission. Since this function will parse ACLs for each AD computer, this can take very long with a larger domain.
Special thanks to Sean Metcalf (@pyrotek3), Will Schroeder (@harmj0y), Karl Fosaaen (@kfosaaen), Matt Graeber (@mattifestation) for research and code with LAPS, AD permissions, and offensive PowerShell.