Linux and macOS implementation of the Local Administrator Password Solution (LAPS) from Microsoft. The client is also executable under Windows and provides additional features (e.g. display additional LDAP values, directly start remote connections and it can be called with laps:// protocol scheme parameter to directly start search).
LAPS in general is a system which periodically changes local admin passwords on domain computers and stores them (encrypted) in the LDAP directory (i.e. Active Directory), where domain administrators can decrypt and view them. This ensures that people who leave the company do not have access to local admin accounts anymore and that every local admin has a strong unique password set.
Microsoft introducted the new "Native LAPS" in 2023. In contrast to Legacy LAPS, the new version uses different LDAP attributes and has the option to store the password encrypted in the LDAP directory. laps-client supports both versions out-of-the-box. The client will search for a password in the following order: Native LAPS encrypted, Native LAPS unencrypted, Legacy LAPS (unencrypted).
The runner can operate in Legacy or Native mode by switching the setting native-laps to true or false. In Native mode, the runner stores the password and username as JSON string in the LDAP attribute, as defined by Microsoft. In addition to that, when in Native mode, you can set security-descriptor to a valid SID in your domain and the runner will encrypt the password for this user/group. Please note: only SID security descriptors are supported (e.g. S-1-5-21-2185496602-3367037166-1388177638-1103), do not use group names (DOMAIN\groupname). If you enable encryption, you should also change ldap-attribute-password to msLAPS-EncryptedPassword to store the encrypted password in the designated LDAP attribute for compatibility with other Tools. Please have a look at the runner section below for more information.
For de-/encryption, the Python dpapi-ng library is used.
The management client enables administrators to view the current (decrypted) local admin passwords. It can be used from command line or as graphical application.
$ ./laps-cli.py notebook01 --set-expiry "2021-04-28 01:01:01"
laps-client CLI v1.0.0
https://github.com/kraloveckey/mini-python/laps-client
🔑 Password for »ldapuser«:
Connection: ldapserver01: user@example.com
Found: CN=NOTEBOOK01,OU=NOTEBOOKS,DC=example,DC=com
Password: abc123
Expiration: 132641316610000000 (2021-04-29 01:01:01)
New Expiration: 132640452610000000 (2021-04-28 01:01:01)
Expiration Date Changed Successfully.
$ ./laps-cli.py "*"
laps-client CLI v1.0.0
https://github.com/kraloveckey/mini-python/laps-client
🔑 Password for »ldapuser«:
Connection: ldapserver01: user@example.com
NOTEBOOK01$ : abc123
NOTEBOOK02$ : 123abc
...
By default, the clients will try to auto-discover your domain and LDAP servers via DNS. If this does not succeed, the client will ask you for this values and write it to the config file ~/.config/laps-client/settings.json.
You can create a preset config file /etc/laps-client.json which will be loaded if ~/.config/laps-client/settings.json does not exist. With this, you can distribute default settings (all relevant LDAP attributes, SSL on etc.) for new users.
Configuration Values
server: Array of domain controllers with items like{"address": "dc1.example.com", "port": 389, "ssl": false}. Leave empty for DNS auto discovery.domain: Your domain name (e.g.example.com). Leave empty for DNS auto discovery.use-starttls: Boolean which indicates wheter to use StartTLS on unencrypted LDAP connections (requires valid server certificate).username: The username for LDAP simple binds.use-kerberos: Boolean which indicates wheter to use Kerberos for LDAP bind before falling back to simple bind.ldap-attributes: A dict of LDAP attributes to display. Dict key is the display name and the corresponding value is the LDAP attribute name. The dict value can also be a list of strings. Then, the first non-empty LDAP attribute will be displayed.ldap-attribute-password: The LDAP attribute name which contains the admin password. The client will try to decrypt this value (in case of Native LAPS) and use it for Remmina connections. Can also be a list of strings.ldap-attribute-password-expiry: The LDAP attribute name which contains the admin password expiration date. The client will write the updated expiration date into this attribute. Can also be a list of strings.ldap-attribute-password-history: The LDAP attribute name which contains the admin password history. The client will try to decrypt this value (in case of Native LAPS) and use it to display the password history. Can also be a list of strings.connect-username: The username which will be used for Remmina connections. May be modified by the client during the runtime since Native LAPS also stores username information.
If you want to view the DSRM password, simply put msLAPS-EncryptedDSRMPassword and msLAPS-EncryptedDSRMPasswordHistory into the ldap-attributes and ldap-attribute-password|ldap-attribute-password-history configuration.
The client (both GUI and CLI) supports Kerberos authentication which means you can use the client without entering a password if you are logged in with a domain account and have a valid Kerberos ticket (for this, an SSL connection is required). If not, ldap3's "simple" authentication is used as fallback and the client will ask you for username and password. The Kerberos authentication attempt can be disabled by setting use-kerberos to false in the config file.
If you did not automatically received a Kerberos ticket on login, you can manually aquire a ticket via kinit <username>@<DOMAIN.TLD>.
By default, laps-client (client and runner) will connect via LDAP on port 389 to your Active Directory and upgrade the connection via STARTTLS to an encrypted one. This means that your server needs a valid certificate and STARTTLS enabled. This behavior can be disabled by modifying the use-starttls in the config file, but it is strongly discouraged to disable it since sensitive data is transferred.
Alternatively, you can use LDAPS by editing the config file (~/.config/laps-client/settings.json): modify the server entry and set ssl to true and port to 636 (see example below). You can also configure multiple static LDAP servers in the config file.
If you are managing multiple domains, you probably want to search for a computer in all domains. Please use the global catalog for this by setting the option gc-port in the configuration file of all servers, e.g. to 3268 (LDAP) or 3269 (LDAPS).
Example
{
"server": [
{
"address": "dc.example.com",
"port": 636,
"gc-port": 3269,
"ssl": true
},
.....
],
.....
}
Since the global catalog is read only, laps-client will switch to "normal" LDAP(S) port when you want to change the password expiry date. That's why, the port option is still required even if a gc-port is given!
laps-client allows you to query additional attributes besides the admin password which might be of interest for you. For that, just edit the config file ~/.config/laps-client/settings.json and enter the additional LDAP attributes you'd like to query into the settings array "ldap-attributes".
The setting ldap-attribute-password-expiry defines in which LDAP attribute the date will be written when selecting a new expiration date. If you like, you can hide the "Set Expiration" button by entering an empty string for this setting.
With the setting ldap-attribute-password you define which LDAP attribute is considered as the admin password (for usage with the Remmina connect feature).
The clients (GUI and CLI) are also executable under Windows and macOS. It's ported to Windows because of the additional features that the original LAPS GUI did not have (query custom attributes, OCO integration).
The GUI supports the protocol scheme laps://, which means you can call the GUI like laps-gui.py laps://HOSTNAME to automatically search HOSTNAME after startup. This feature is mainly intended to use with the OCO server web frontend ("COMPUTER_COMMANDS").
Computer objects in the Microsoft Active Directory can not be longer than 15 characters. If you join a computer with a longer hostname, it will be registered with a different "short name". You have to enter this short name in the config file (setting hostname) in order to make the Kerberos authentication work. You can find out the short name by inspecting your keytab: sudo klist -k /etc/krb5.keytab.
Set the hostname option to null (default) to use the system's normal host name.
If the script throws an error like kinit -k -c /tmp/laps.temp SERVER$ returned non-zero exit code 1, please check what happens when you execute the following commands manually on the command line.
sudo kinit -k -c /tmp/laps.temp COMPUTERNAME$
sudo klist -c /tmp/laps.temp
Please replace COMPUTERNAME with your hostname, but do not forget the trailing dollar sign.