Windows LAPS should have a dedicated password retrieval UI

Windows LAPS should have a dedicated password retrieval UI



 May 07 2023
6 Comments (6 New)
In the backlog

Many customers have asked for Windows LAPS to support a suitable replacement for the legacy LAPS UI (AdmPwd.UI.exe). Yes we have the new LAPS tab in ADUC but it seems many customers don't use ADUC that much, especially for helpdesk workers.  Also, ADUC does not have the ability to display password history (frankly there's just not enough UI real-estate left in that dialog).


I would really like to hear feedback from customers on what scenarios a new Windows LAPS UI should support. Off the top of my head, it should:


1. Support targeting of a specific forest

2. Support searching for a specific computer account by various name forms, or by object picker

3. Support setting of the password expiration timestamp

4. Support retrieving of both the current password and password history


A more exotic idea would be a "RDP Connect to device" button which would combine 1) pwd retrieval; 2) on-the-fly creation of an RDP shortcut with password; 3) launching the RDP client.  


Looking forward to hearing other suggestions on this topic! :)

Copper Contributor

Some mechanism is required to manage the windows laps from the helpdesk admin workstation.

Copper Contributor

I'd like to give the Helpdesk a published App for LAPS GUI, however, i now need to publish them Full DSA in order to retrieve passwords. So yes, a dedicated full UI would be helpful!

Iron Contributor

Hello, why not build a dedicated Windows LAPS extension for Windows Admin Center, instead of another GUI ?


@Alban1998 -- a WAC extension is also on the backlog.   I don't know enough about WAC to say whether it would fully replace all scenarios that would be satisfied by a dedicated in-box GUI app.  Ideally we can do "all of the above", but no promises on that.

Status changed to: In the backlog
Copper Contributor

this is desperately needed.  Our field tech's dont always have full access to AD or powershell.  a simple GUI I could present to them via application streaming/RDP applications or whatever would be pretty **bleep** nice.  until then, we literally cannot use laps, since our primary users, cant view passwords from their place of work always.