SERVER-028 · Script

Manage Local Administrator Passwords

Shows which computers have their local administrator password managed by LAPS, and can force a new password.

What it does

Report mode (default) checks every enabled computer in -SearchBase and shows:

• Windows LAPS: the password expiry time stored by Windows LAPS
• Legacy LAPS: the expiry time stored by the older Microsoft LAPS, if that schema is present
• Status: Managed, Expired (the computer has not rotated its password on time),

or Not managed (no LAPS password stored at all) The script reads only expiry times. It never reads, shows or saves the passwords themselves.

Expire mode marks the current password as expired for the computers listed in -ComputerName, so each one sets a new password the next time it processes policy. Use it after an admin password was shared or a technician leaves. Expire only works on the names you list, never on a whole OU.

Requirements

Windows PowerShell 5.1 and the ActiveDirectory module (RSAT). Report: read access to the computer objects.

How to run it

• Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
• Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
• Script type: PowerShell 5.1, 64-bit
• User interaction: none; the script never prompts
• Timeout: 30 minutes for large directories or many servers

Settings

Exit codes

• 0 = All computers managed, or all expirations done
• 1 = Expired or unmanaged computers found, or some expirations failed
• 2 = Script error (see log)

Testing steps

1. Run it first with the mode set to Report on one test OU, test account or test server. Nothing is changed in that mode.
2. Read the log and confirm the planned changes are what you expect.
3. Run your chosen settings on the same test target and confirm the result.
4. Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
5. Roll out to a small group next, then everyone.

Rollback steps

Report mode changes nothing and never reads passwords. Expire cannot be undone, and does not need to be: each computer simply sets a new password at its next policy refresh.

Version and change log