1

This route uses powershell and CMD if powershell remote management is disabled in group policy.

  • Total time: 10 minutes to do, a day to wait. Recommend testing for you own sake
  • Estimated cost: 0
  • Tools used: CMD,Powershell,GP,PSexec,LAPs

Step 1: Share/Permissions required

You will need a share folder with read, write, modify and execute for the scripts to run under whatever particular user/group you choose.

Ability to manage group policy.

The person running these scripts will require local admin for each machine and domain read permissions for ms-Mcs-AdmPwd attribute.

Delegatable with

Set-admPwdReadPasswordPermission -allowedprincipals "groupname"

Step 2: Group Policy Setup

4 options are available to change within group policy. This should be done first.

Computer > Policies > Administrative Templates > LAPs

  • Password settings (length and age)
  • Name of administrator if you aren’t using the default administrator for local admin
  • do not allow password expiration longer than required
  • Enable local admin password management

Enable all and configure all to your needs within the expected OUs. Allow time for this to propagate.

Step 3: Powershell Getting the useful information

In this part we will grab all of the computers of the chosen OU for the ability to roll out in smaller chunks. Verify if they have already had LAPs enabled and verify if they are currently online. Output to a text file readable by CMD all computers that are currently online and do not have LAPs updated in the computer attribute.

Also, it gives some feedback so you don’t feel like you’re sitting around and hoping it’s working.

Step 4: Powershell Code Generified

$OutputFile = "\\your\file\location\machine.txt"
$list = (Get-ADComputer -Filter * -SearchBase “OU=workplace,DC=contoso,DC=org”)
$NeedLaps = @()
$FinalOutput = @()

foreach($name in $list){

    if((Get-AdmPwdPassword -ComputerName $name).password -eq $null){

        $NeedLaps += $name.Name

    }
    
    
}
echo "Testing Connectivity"
foreach($computer in $NeedLaps){
    
    if((Test-Connection $computer -Count 1 -Quiet) -eq $true){
        $computer
        $FinalOutput += $computer

    }

}


$FinalOutput | Out-File -encoding ASCII  $OutputFile

Step 5: CMD\psexec

Using this part is specific to not having remote managment enabled via powershell in your company. Otherwise you could work it into the powershell script fairly easily.

This part reads the file you just created for the list to iterate through. Should roll pretty quickly because everything was verified needing and currently online when you ran the previous script.

Step 6: CMD Generified

FOR /f %%a in (\\your\file\location\machine.txt) do (
MKDIR \\%%a\c$\temp\LAPS\
copy "\\your\file\location\LAPS\AdmPwd.dll" \\%%a\c$\windows
\\your\file\location\psexec\psexec.exe \\%%a regsvr32 /s c:\windows\AdmPwd.dll
)

This is a reasonably easy way to still have a local administrator account, but increase the security on it as each computer will have its own randomized password. This particular setup is a little convoluted as I needed to have psexec in command prompt do the work while getting the information from powershell was significantly easier.

2 Spice ups