Microsoft LAPS: Reduce lateral movement risks

Introduction

Lateral movement is a common part of an attacker’s path through a compromised Windows environment. After gaining an initial foothold, an attacker can use available credentials to move between computers, look for more valuable accounts, and ultimately reach sensitive systems or data. The CERT-EU guidance on detecting lateral movements in Windows infrastructure explains the techniques and why the use of valid credentials can make them difficult to distinguish from normal administration.

Unique, regularly managed local administrator passwords do not solve every security problem, but they remove one particularly useful opportunity for an attacker: reusing the same local administrator credential across many Windows computers. Microsoft LAPS helps implement this control, and JDisc Discovery can use LAPS-managed credentials for discovery while keeping the access model transparent and reviewable.

Why local administrator passwords matter for lateral movement

Lateral movement describes the use of a compromised computer, account, or credential to access additional systems. Attackers often work sideways through devices and services before they can reach a higher-privileged account or a sensitive resource. Well-known incidents such as SolarWinds, WannaCry, and NotPetya illustrate why reducing credential reuse and limiting administrative access matter in practice.

Microsoft recommends several complementary measures for reducing lateral movement risk: restrict privileged domain accounts, protect local accounts with administrator privileges, and restrict inbound traffic with Windows Defender Firewall. This article concentrates on the second point: protecting local administrator accounts with Microsoft LAPS.

What Microsoft LAPS changes

Microsoft LAPS automates the management of local account passwords. It can generate a unique random password for each managed local administrator account and stores the password in a confidential attribute of the related computer account in Active Directory. This reduces the risk that one reused local password gives access to many computers.

The original Microsoft LAPS download remains a useful reference for legacy deployments. JDisc Discovery has supported Microsoft LAPS for some time; our earlier article explains the Microsoft LAPS integration with JDisc Discovery.

Configuring Microsoft LAPS for discovery

For native, encrypted Microsoft LAPS, JDisc Discovery needs two clearly separated configuration elements:

1. Credentials for access to domain controllers when JDisc Discovery needs to deploy the JDisc Discovery Zero-Footprint Agent. These are required when the computer running JDisc Discovery is not part of the same Active Directory domain or runs as a standalone system.
2. Credentials that can retrieve and decrypt the confidential LAPS administrator account/password attribute.

Separating these roles makes it easier to apply least privilege and to review which account is used for which purpose.

Configure domain controller access credentials

In the Discovery Configuration dialog, open Scope > Directory and select the directory object that contains your domain controllers.

Use Change Account to enter the domain controller access credentials, such as JDISC-LAPS\\DCADMIN. JDisc Discovery uses this account to deploy the Zero-Footprint Agent and gather data from the domain controllers. In a pure zero-footprint deployment, the account therefore needs local administrator privileges on the domain controllers.

Using a highly privileged account for discovery deserves careful consideration. Where operationally possible, you can pre-deploy and configure the JDisc Discovery Zero-Footprint Agent on domain controllers with your software deployment tools. JDisc Discovery’s privilege elevation capability can then allow a lower-privileged domain user to communicate with the agent and collect device details without using that account as a local administrator for the discovery connection.

Configure the LAPS password reader account

Next, open Scope > LAPS in the Discovery Configuration dialog and enable the directory objects whose computers should use Microsoft LAPS. Select the relevant object, such as the Windows 10 object in the example, and then choose Change LAPS Account.

Provide an account that is permitted to retrieve and decrypt the confidential LAPS administrator account/password attribute. Microsoft provides the Set-LapsADReadPasswordPermission PowerShell cmdlet to delegate exactly this read permission for an organizational unit and a selected user or group.

If the LAPS account, for example JDISC-LAPS\\LAPSPWDREADER, differs from the domain controller access account, configure it for privilege elevation in the JDisc Discovery Zero-Footprint Agent as well. This lets the two accounts retain their distinct responsibilities.

Check the Zero-Footprint Agent configuration

After both accounts are configured, the deployment configuration for the domain controllers should reflect the selected credentials and elevation settings.

For implementation details, see the chapter Using Microsoft LAPS in the JDisc Discovery Security Guide.

Handle Limited User Account behavior deliberately

Discovery can use Microsoft LAPS-managed local administrator credentials, but the effective Windows access token still matters. If the built-in Administrator account is the LAPS-managed local administrator, discovery can collect the expected information. If the LAPS-managed account is only a local user that belongs to the local Administrators group, Windows can apply Limited User Account (LUA) behavior and the discovery result may be limited to basic information.

The practical way to address this is the same as for domain controllers: pre-deploy and configure the JDisc Discovery Zero-Footprint Agent on the Windows computers, then use privilege elevation for the designated local LAPS administrator account. This keeps the discovery workflow aligned with a least-privilege approach while allowing JDisc Discovery to obtain the device details it needs.

Make LAPS part of a broader discovery security model

Microsoft LAPS is most effective when it is one part of a wider approach: unique local administrator passwords, controlled administrative access, suitable firewall rules, and an accurate inventory of the systems and accounts in use. JDisc Discovery helps keep that inventory current while supporting an access model that can be scoped and reviewed.