COMMAND EVERYTHING.

Get-LapsADPassword

Queries Windows Local Administrator Password Solution (LAPS) credentials from Active Directory (AD) on a specified AD computer or domain controller object.

PowerShell · Risk: Low · Documentation Verified

Last verified: 2026-10-26

Microsoft LAPS reference: Queries Windows Local Administrator Password Solution (LAPS) credentials from Active Directory (AD) on a specified AD computer or domain controller object. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.

Get-LapsADPassword [-Credential <PSCredential>] [-DecryptionCredential <PSCredential>]
 [-IncludeHistory] [-AsPlainText] [-Identity] <String[]> [<CommonParameters>]

Copied 0 times

Required permissions

Use an account with the target resource permissions documented for Get-LapsADPassword. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.

Supported environments

Windows / LAPS · Windows Server 2025 documentation; feature/module prerequisites apply

Parameters

-AsPlainText: Specify this parameter to return the LAPS passwords in clear-text format. The default behavior is to return the LAPS passwords wrapped in a .NET SecureString object. > [!IMPORTANT] > Using this parameter exposes the returned clear-text password to casual viewing and may pose a > security risk. This parameter should be used with caution and only in support or testing > situations.
-Credential: Specifies a set of credentials to use when querying AD for the LAPS credentials. If not specified, the current user's credentials are used.
-DecryptionCredential: Specifies a set of credentials to use when decrypting encrypted LAPS credentials. If not specified, the current user's credentials are used.
-Domain (required): Specifies the name of the domain to connect to.
-DomainController (required): Specifies the name of the domain controller to connect to, or the remote server on which an AD Snapshot Browser is running.
-Identity (required): Specifies the name of the computer or domain controller object to retrieve LAPS credentials from. This parameter accepts several different name formats that influence the criteria used when searching AD for the target device. The supported name formats are as follows: - distinguishedName (begins with a CN=) - samAccountName (begins with a '$") - dnsHostName (contains at least one '.' character) - name (for all other inputs)
-IncludeHistory: Specifies that any older LAPS credentials on the computer object should also be displayed.
-Port (required): Specifies the AD Snapshot Browser port to connect to.
-RecoveryMode (required): This parameter provides a last-ditch option when it's no longer possible to decrypt a given LAPS credential via the normal mechanisms. For example, this might be necessary if a LAPS credential was encrypted against a group that has since been deleted. >[!IMPORTANT] > When specifying this parameter, you must be logged-in locally as a Domain Administrator on a > writable domain controller.

Prerequisites

Windows with the LAPS module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.

Security considerations

This is a read-oriented cmdlet; protect any sensitive results and check the documented effects of your selected parameters.

Examples

Example 1

Get-LapsADPassword LAPSCLIENT

This example demonstrates querying the current LAPS password for the LAPSCLIENT computer in the current domain. The password was stored in AD in clear-text form and didn't require decryption. The password was returned wrapped in a SecureString object. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.

Sources

https://github.com/MicrosoftDocs/windows-powershell-docs/blob/b7645dd8c687139b28e845119da30ec670526507/docset/winserver2025-ps/LAPS/Get-LapsADPassword.md

https://learn.microsoft.com/powershell/module/laps/get-lapsadpassword?view=windowsserver2025-ps

Personal collections

Explain or customize this command with AI

Related commands