Protect your LAPS passwords with MFA
LAPS passwords stored in Active Directory are vulnerable to harvesting with stolen admin credentials. Lithnet Access Manager provides a secure web app for users to access LAPS passwords from, which allows you to apply your identity provider's MFA and conditional access rules upon sign-in.
Professional edition from USD 750 a year, including 100 devicesOrder online for up to 1,000 devicesFree Community edition for up to 100 devices
Who can read your LAPS passwords today?
LAPS passwords in Active Directory are protected only by directory permissions. Anyone with that permission can read as many passwords as they like, with no MFA and no limit, so one compromised admin account can be all an attacker needs to log on to every computer that account looks after.
Access Manager puts a secure sign-in in front of those passwords. Your team reads them in a web app protected by your identity provider's MFA and conditional access, so a stolen password alone won't get anyone in, and rate limits stop any one account from reading the passwords for every computer at once.
Learn more about Lithnet Access ManagerHow it works
- 1Your technician signs in to the Access Manager web app, and your identity provider applies your MFA rules.
- 2Access Manager checks that your rules let them see this computer's password and that they're within your rate limits.
- 3Access Manager shows the password and records the request.
Industry-standard single sign-on in every edition
Access Manager supports single sign-on through OpenID Connect providers such as Microsoft Entra ID and Okta, and through Active Directory Federation Services (ADFS). You manage the MFA and conditional access rules for Access Manager in your identity provider, alongside the rules for your other apps. There is no SSO tax, even on the free Community edition.
Prevent mass-harvesting of LAPS passwords
If an attacker gets hold of an account that can read LAPS passwords in Active Directory, nothing stops them from extracting every LAPS password in your organization in seconds. Access Manager prevents this with rate limits for each user and each IP address. If someone with access to Access Manager has their account compromised, the limits reduce the damage they can do. Every refused request is recorded in the audit log.
Know who asked for every LAPS password
Finding out who read a LAPS password in Active Directory means turning on the right auditing in advance and then searching the event log on every domain controller. Access Manager records every request in one place, whether it grants the request or denies it. Each event shows who asked, for which computer, when and from which IP address.
Migrate your existing LAPS permissions to Access Manager
When your team reads LAPS passwords only through Access Manager, your sign-in rules, rate limits and audit events cover every password they read. To help you migrate your team, Access Manager can import your existing Windows LAPS read permissions into Access Manager rules.
Read LAPS passwords from Active Directory and Microsoft Entra ID in one web app
Access Manager can read LAPS passwords wherever they're stored: in Active Directory, in Microsoft Entra ID for Windows LAPS, and in its own database for devices that run our agent. Your team gets every LAPS password from one web app. The same sign-in, authorization rules, rate limits and audit events apply to each password, no matter where it is stored.
Compare Access Manager and Windows LAPSGo passwordless with RapidLAPS
With RapidLAPS, your technicians can log on as the local admin without ever having to type or even know the LAPS password. They scan a QR code on the Windows logon screen, sign in to Access Manager on their phone and approve the logon request. Your identity provider applies your MFA rules to that sign-in.
How RapidLAPS worksAlso included
BitLocker recovery keys
The BitLocker recovery keys in Active Directory get the same sign-in, rate limits and audit events as your LAPS passwords.
Just-in-time admin access to computers
Through the same web app, admins can request access to a computer, and be granted temporary local admin rights. Access Manager automatically removes the rights when the allowed time period expires.
Just-in-time access to roles
Through the same web app, admins can request a role made from any Active Directory group, such as the group that administers an application or a set of servers. Access Manager adds them to the group and removes them again when the allowed time period expires.
Frequently asked questions
Do we have to replace Windows LAPS?
No. Access Manager reads your existing Windows LAPS passwords, so you can keep LAPS as it is.
What is the Access Manager agent?
The Access Manager agent is an optional program for your Windows, macOS and Linux devices, and you configure it to do exactly what you need. It can manage the local admin password and store it securely in Access Manager, generate passphrases from your own word lists, back up BitLocker recovery keys from your Windows devices, and give your team RapidLAPS passwordless logon and elevation. You can run it on every device, or alongside Windows LAPS on some of them.
Do I need to install the Access Manager agent?
The Access Manager agent provides a range of features above and beyond what Microsoft LAPS provides, but it is not required if you only want to access Windows LAPS passwords from the Access Manager web app. Deploy the Access Manager agent if you want to use RapidLAPS, back up BitLocker recovery keys from your devices, or use LAPS passphrases based on custom word lists.
Do all my passwords need to be in one place?
No. Access Manager reads LAPS passwords wherever they are stored: in Active Directory, in Microsoft Entra ID, or in its own database for devices that run the Access Manager agent. Your team finds every one of them in the same web app.
Can I mix and match password locations?
Yes. You can use Windows LAPS on some devices and the Access Manager agent on others, and Access Manager reads the passwords from all of them.
We don't use LAPS yet. Where do we start?
Start with the Access Manager agent. Deploy it to your Windows, macOS and Linux devices, and every one of them gets its own managed local admin password, with RapidLAPS and passphrases ready for your team from day one.
How does Access Manager compare with a privileged access management (PAM) suite?
PAM suites cover many kinds of privileged accounts, such as domain admin and service accounts, and often add password vaulting and session recording. Access Manager focuses on admin access to your computers. It covers local admin passwords through LAPS, RapidLAPS, BitLocker recovery keys and just-in-time admin rights.
Get started today
Paid editions start at USD 750 a year and include support from Lithnet. The Community edition includes every sign-in method and is free for up to 100 devices.
The free trial unlocks every feature for 30 days on a free installation.