6.3.8 Validate LAPS and gMSA read access
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
A selected computer or managed service account and evidence of the relevant delegated secret-read/decryption rights.
Where to look: Inspect the applicable LAPS schema/attributes and read permissions on the named computer; for gMSA inspect the allowed managed-password readers and resulting blob format. Tie the material to its exact host/account.
Expected behavior / secure boundary: LAPS and gMSA are protective management mechanisms. Merely seeing their objects is not a vulnerability. Secret-bearing attributes should be restricted; encrypted Windows LAPS content additionally depends on permitted decryption context.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.3.8.1 Baseline — Shell
Run: Kali / Linux with bloodyAD. Requires: LDAP authentication, matching schema/object and effective secret-read/decryption rights. Effect: Reads selected sensitive attributes; does not grant those rights.
6.3.8.1.1 Classic LAPS: password for the relevant computer's local administrator
# Classic LAPS: password for the relevant computer's local administrator
bloodyAD --host DC_HOST -d DOMAIN -u USER -p 'PASSWORD' \
get object 'COMPUTER$' --attr ms-Mcs-AdmPwd
6.3.8.1.2 Windows LAPS: returned content/format depends on schema and protection
# Windows LAPS: returned content/format depends on schema and protection
bloodyAD --host DC_HOST -d DOMAIN -u USER -p 'PASSWORD' \
get object 'COMPUTER$' --attr msLAPS-Password
6.3.8.1.3 gMSA: inspect the allowed managed-password attribute
# gMSA: inspect the allowed managed-password attribute
bloodyAD --host DC_HOST -d DOMAIN -u USER -p 'PASSWORD' \
get object 'GMSA$' --attr msDS-ManagedPassword
What this checks: The examples query selected attributes under an explicit identity. Classic and Windows LAPS use different attributes/formats. A gMSA managed-password blob must be decoded by a compatible implementation before treating derived key material as an authentication input.
6.3.8.2 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
Computer: APP01$
Attribute: ms-Mcs-AdmPwd
Result: readable value (redacted)
gMSA result: encoded managed-password blob
Another result: attribute absent
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| APP01 LAPS value | A secret associated with that computer's managed local account. | Establish the actual account name/current value and validate on APP01. | §6.4.1.1 — Select a compatible remote-access mechanism |
| gMSA blob | Structured managed-password material. | Decode with the documented compatible tool; it is not a ready-to-use NT hash string. | §6.3.2.1 — Classify recovered credentials and their scope |
| Attribute absent | Could be schema, empty data, permissions or wrong object. | Do not conclude LAPS is disabled from this output alone. | §6.3.8.1 — Validate LAPS and gMSA read access |
Stop when: The named account/host, attribute format and effective read/decryption boundary are known.
Revisit only when: Secret rotation, schema, identity or delegated read/decryption rights changes.
6.3.8.3 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | Permitted read/decryption yields typed material: map its account and compatible access. | §6.3.2.1 — Classify recovered credentials and their scope |
| Ruled out in this context | The identity lacks the necessary read/decryption right: rule out this branch in that context. | §6.2.5.1 — Enumerate and validate effective object permissions |
| Inconclusive / failed check | Missing/opaque attribute: distinguish schema, protection and access before deciding. | §6.3.8.1 — Validate LAPS and gMSA read access |
6.3.8.4 Tooling and complete procedure
bloodyAD queries selected LDAP attributes; Windows LAPS/RSAT tools and compatible gMSA parsers are alternatives. Directory authentication, schema support and effective rights are prerequisites. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.