Local Administrator Password Management: Why LAPS Alone Is Not Tier Separation

Windows Local Administrator Password Management (LAPS) addressed a genuine issue, but it falls short of providing true tier separation. Prior to LAPS, workstations often shared the same local administrator password, recorded in a neglected spreadsheet. By implementing LAPS, organizations mitigated a common lateral movement tactic used in numerous large-scale cyber intrusions over the past decade.

However, LAPS alone does not eradicate the potential for lateral movement. LAPS enforces a unique, periodically refreshed password for each local administrator account, securely storing it in Active Directory or Entra ID with controlled access. This enhances security by preventing a compromised workstation from serving as a gateway to other workstations.

Yet, LAPS does not address the broader spectrum of potential compromises. It does not cover additional local accounts generated by applications or operators, nor does it account for locally renamed or created accounts outside the LAPS purview. Domain cached credentials and service accounts continue to pose risks. Tier separation is the logical next step.

This model categorizes identities and systems according to the assets they control. Tier 0 encompasses the directory and its administrators, Tier 1 includes servers whose compromise could escalate to Tier 0, and Tier 2 consists of user workstations. A fundamental rule governs this model: a credential from a lower tier must never authenticate to a higher tier.

LAPS does not enforce this rule. Even if each workstation has a unique, rotated password, a domain administrator logging into a compromised workstation with cached credentials leaves exploitable material on that machine. The reverse scenario, where a workstation's credential reaches a domain controller, is the primary target of relay and credential theft attacks.

To enforce the tier separation rule, administrators must authenticate to Tier 0 systems exclusively from specialized, hardened workstations, and never from general-purpose laptops. Interactive logon to domain controllers should be restricted to a designated group, and credential caching on servers should be minimized. Service accounts should be managed and not treated as shared passwords.

LAPS is a Tier 2 control with a significant impact. It is relatively easy to deploy and its effectiveness can be quantified through metrics like the percentage of managed machines with unique rotated passwords. However, tier separation requires additional controls and metrics. LAPS should be implemented before tier separation, as it eliminates the simplest path while more complex measures are underway.

Independent assessments should focus on three key questions: which machines have LAPS deployed and which are exempt, which local accounts exist outside LAPS management, and which accounts can authenticate to Tier 0 systems from a workstation. While LAPS excels at addressing the first question, the remaining inquiries necessitate policy-based measures that LAPS was not designed to provide.