Unable to view LAPS password in ADManager Plus
Issue description
The LAPS password column in the Workstation Computers report of ADManager Plus is empty.
Possible causes
Incorrect LAPS configuration: LAPS might not be correctly configured or deployed.
Permission issues: The user account used by ADManager Plus may lack Read ms-Mcs-AdmPwd permissions to read LAPS passwords.
Prerequisites
Ensure you have admin access for ADManager Plus and server.
Resolution
Step 1: Verify permissions in ADManager Plus (if the issue affects a technician but not the built-in admin)
Log in to ADManager Plus as an administrator.
Navigate to the Delegation tab.
Click the Edit icon in the Actions column for the technician experiencing the LAPS issue.
Click Show Advanced and ensure that the Display LAPS information in reports option is checked. If it is not, check it and save the changes.
Have the technician log out and log back in for the changes to take effect.
Step 2: Verify the users' permissions for reading LAPS passwords
Open Active Directory Users and Computers (ADUC).
Navigate to the organizational unit (OU) where LAPS-managed computers are stored.
Right-click the OU and select Properties.
Go to the Security tab and click Advanced.
Locate the ADManager Plus service account and confirm it has the Read ms-Mcs-AdmPwd permission.
If the permission is not granted, check-in Read ms-Mcs-AdmPwd to grant permission.
Click Apply and restart ADManager Plus to ensure the new permissions take effect.
Step 3: Verify LAPS configuration
Use PowerShell to verify that the LAPS password can be retrieved.
Run Get-AdmPwdPassword -ComputerName <ComputerName> command in PowerShell. Replace <ComputerName> with the name of a workstation.
Tips
Regularly audit and restrict access to LAPS-managed passwords to ensure only authorized personnel can retrieve them.
Related topics and articles
How to reach support
If the issue persists, contact our support team here.New to ADSelfService Plus?
Related Articles
How to display and export LAPS Information in reports
Steps to allow technicians to export the LAPS password in reports: 1. Log in to ADManager Plus. 2. Navigate to the Admin tab. 3. Under General Settings, click Security and Privacy. 4. In the Privacy Settings tab, check the Allow technicians to export ...How to generate and export LAPS information in reports using ADManager Plus
Objective This article explains how to retrieve and export Local Administrator Password Solution (LAPS) information using ADManager Plus. LAPS helps you securely manage the local administrator passwords of domain-joined computers. By configuring ...Why is a technician unable to view or manage Microsoft 365 licenses using ADManager Plus?
Issue description A technician may be unable to view assigned Microsoft 365 licenses using ADManager Plus. This typically occurs when the necessary permissions are not configured correctly or when the service account used to connect to the Microsoft ...Password Policy report in ADManager Plus
The Password Policy report in ADManager Plus is generated by querying the LDAP attributes of the domain object, such as minPwdAge, maxPwdAge, minPwdLength, pwdHistoryLength, and pwdProperties. These attributes are determined by the Group Policy ...The technician is unable to view or modify scheduled automation in ADManager Plus
Issue description In ADManager Plus, scheduled automations are configured by default to be accessible only to the technician who created them and the built-in administrator. As a result, help desk technicians may be unable to view or modify ...