What's going on, guys?
It is Bernardo, and today is all about setting up Windows
LAPS, LAPS stands for Local Administrative Password Solution.
So let's get right into it.
Okay, So I'm going to show you what version of my operating system
that I'm running because Windows LAPS is actually embedded within.
I think, two versions.
Well, these are the only two versions that I know, I think 2019 and 2022.
But it was a particular Windows update that those two operating systems needed.
I'm going to show you guys which KB you need.
But the operating system that I'm running right now,
if I right click on the start menu, go to run type in Winver
hit okay, I'm running everything on a Windows Server 2022.
Now, if you have been pushing out all your security updates to your 2019
or 2022, you should already have Windows LAPS already inside your operating system.
I didn't have it because this is my lab, so I actually had to get this KB,
which is KB 5025230.
This security update was pushed out April 11th of this year.
And if you scroll down a little bit, you're going to see that
one of the new features of this particular KB is this. New!
This update implements the new Windows Local Administrative
Password Solution, which is LAPS as a Windows Inbox feature.
For more information, see by popular demand Windows LAPS available now.
If you didn't update your machines like I typically don't do with my labs,
which I have to you could go inside the Microsoft update catalog site,
just locate that KB, hit search and just locate the one that you want.
You have two flavors.
You got the 21H2 or the 22H2 type.
So pick which one you want.
This is the one that I'm
going to do, which is 21H2 and I'm just going to click
on that hyperlink it’s going to start downloading that MSU file.
Once it's completed, I'm going to go inside the downloads
folder and I'm going to right click on it and then click on Open.
It's going to search for the update on that computer
if that update is needed, you're going to get prompted this.
This is a good thing.
Click Yes, it's going to initialize the installation.
Once the initialization is done,
it's going to start installing the security update.
Eventually you're going to get this.
It wants you to restart.
So hey, click on restart now.
It's going to start restarting the machine and start working on the update.
It's going to reboot itself and then you log back into your machine.
Once you log into your machine, you're going to click on the start menu
and then you're going to right click on Windows PowerShell. You’re
going to run it as an administrator, we’re going to do some PowerShell.
I love doing PowerShell. It makes life easier.
Now the first command that we're going to do is import module LAPS, right?
For those that already have that KB
this is the first thing that you need to do Click Enter.
It's going to import those modules into this session.
Now, the next command that we're going to
do is get command with a parameter of module LAPS.
I want to know the list of all the commands
that this LAPS provides, and this is everything that you're able to do.
Now, the very first command that we need to do is update our schema.
So we're going to do update LAPS AD
schema, hit enter, and I'm going to be super lazy on this one.
I'm just going to hit A for all, hit enter and the schema is done.
Now the way that you are able to confirm if your schema is up
to date, open up Active Directory for me.
I want inside my domain controllers OU and I opened up my domain controller
computer object.
You're going to see one new tab,
but a bunch of other features within the attribute editor.
And if you scroll all the way down MS LAPS,
you're going to see a bunch of new stuff that was added.
If you go inside the LAPS tab, you're going to see more stuff
that was added here.
If you click on show
password, it actually gives you the LAPS DSRM account password.
Now you are able to grant computer objects to write to manage
their own LAPS password. And this is how you do it.
I'm actually going to grant the permission on a OU level.
And this is the OU that I'm going to grant that permission.
Let's head to PowerShell.
We're going to use the following command, which would be set LAPS AD computer
self permission with a parameter of identity
and you're OU location, hit enter and you're done.
Now you are able to manage your windows LAPS via group policy
and this is how you do it.
On the desktop, we're going to click on Start within start we're going to open up
the Windows administrative Tools folder and we're going to locate
where we are you, group policy management, click on that.
It's going to load this up and we're going to open up the group policy objects.
We're going to right click on that
and then click on new and we’re going to give it a name.
Now, this policy actually hits to a computer configuration node.
So this is the following name that I'm going to do.
Computer Microsoft LAPS policy.
Click. Okay,
Locate your new GPO, right click on it.
Click on Edit.
And then once you click on edit, we're going to go inside computer configuration.
Within computer configuration, we're going to go inside policies.
Within policies.
We're going to go inside administrative templates within administrative templates.
We're going to go inside system.
Now, within systems, there's a folder called LAPS
and these are all the settings that you have for your LAPS.
Now, the first one that we're going to configure would be enable password backup
for your DSRM account.
So double click on it.
We're going to enable it.
We're going to apply and then, Okay, Now the second setting that
we're going to configure would be name of administrative account to manage.
So we're going to double click on that, we're going to enable it
and then you're going to provide your administrative account name.
Now for me, I have it stand there as administrator,
but most likely a lot of you guys might have administrative disabled
and you might have another account that is acting as your admin.
So just add it here
and then once you're done, apply and then, okay it,
now the next setting that we're going to configure would be configure
password backup directory.
So double click on that one.
We're going to enable it
and your backup directory by default, it is Azure Active Directory.
So we're going to click on the dropdown menu and pick Active Directory
we’re going to apply and then Okay it.
Now the last setting that we're going to configure would be the password settings.
So locate that double click on it.
We're going to enable it.
I'm going to leave all the options as the default,
but you are able to change the password length and the age.
But again, I’m going to leave everything as the default apply and then okay it.
Once your done, close your GPO, locate your OU, right click on that OU
click on Link an existing GPO,
select your GPO, click okay and then apply it and then that's it.
Hopefully guys enjoy this video and I catch you guys on the next one, peace out.