COMMAND EVERYTHING.

Set-LapsADPasswordExpirationTime

Sets the Windows Local Administrator Password Solution (LAPS) password expiration timestamp on an Active Directory (AD) computer or domain controller object.

PowerShell · Risk: High · Documentation Verified

Last verified: 2026-10-26

Microsoft LAPS reference: Sets the Windows Local Administrator Password Solution (LAPS) password expiration timestamp on an Active Directory (AD) computer or domain controller object. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.

Set-LapsADPasswordExpirationTime [-Credential <PSCredential>] -Identity <String[]>
 [-WhenEffective <DateTime>] [-Domain <String>] [-DomainController <String>] [<CommonParameters>]

Copied 0 times

Required permissions

Use an account with the target resource permissions documented for Set-LapsADPasswordExpirationTime. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.

Supported environments

Windows / LAPS · Windows Server 2025 documentation; feature/module prerequisites apply

Parameters

-Credential: Specifies the credentials to use when updating AD. If not specified, the current user's credentials are used.
-Domain: Specifies the name of the domain to connect to.
-DomainController: Specifies the name of the domain controller to connect to.
-Identity (required): Specifies the name of the computer or domain controller object to set the LAPS password expiration time on. This parameter accepts several different name formats that influence the criteria used when searching AD for the target device. The supported name formats are as follows: - distinguishedName (begins with a CN=) - samAccountName (begins with a $) - dnsHostName (contains at least one . character) - name (for all other inputs)
-WhenEffective: Specifies the new LAPS password expiration time. If not specified, the current time is used, which expires the password is immediately.

Prerequisites

Windows with the LAPS module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.

Security considerations

This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.

Examples

Example 1

Set-LapsADPasswordExpirationTime -Identity lapsClient

This example shows setting the LAPS password expiration time to the current time, which expires the password immediately. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.

Sources

https://github.com/MicrosoftDocs/windows-powershell-docs/blob/b7645dd8c687139b28e845119da30ec670526507/docset/winserver2025-ps/LAPS/Set-LapsADPasswordExpirationTime.md

https://learn.microsoft.com/powershell/module/laps/set-lapsadpasswordexpirationtime?view=windowsserver2025-ps

Personal collections

Explain or customize this command with AI

Related commands