Automatic password management in the domain

Some of the attacks from previously, for example, MS14-025 and Kerberoasting, contributed to the development of password management automation. To resolve the problem of local administrator password rotation, LAPS was created. To tackle Kerberoasting, gMSA was introduced a bit later by Microsoft.

LAPS

Now, we will deploy LAPS on braavos in the essos domain and discuss possible attack venues. I will follow this deployment guide[25]. The general steps include component installation, Active Directory schema extension, agent deployment on computers, and Group Policy configuration.

The installation is straightforward. Just download the .msi file and deploy it. After running the following command, your schema will be extended (run as schema admin):

Update-AdmPwdADSchema

The output would be like what is shown in the following screenshot:

Figure 4.15 – Schema update was successful

The next step is...