No permission to retrieve LAPS Password or no LAPS Password set!

[c-cuthbert]

I am receiving this message when attempting to retrieve the LAPS password for computers. I have confirmed the computers have LAPS password set and I'm using a Domain Admin account which definitely has permission.

I'm not seeing anything helpful in logging to narrow down whats causing this. Would really appreciate any ideas!

[Seji64]

Does the DN or the OU where the computer is located has any special characters ?

[c-cuthbert]

Hi there, No, I've tried a couple of OUs, all behave same way. Regards, Christian Get Outlook for Android<https://aka.ms/AAb9ysg>

…

________________________________ From: Seji ***@***.***> Sent: Friday, October 18, 2024 7:44:06 PM To: Seji64/LAPS-WebUI ***@***.***> Cc: Cuthbert, Christian (NCMI, Hobart) ***@***.***>; Author ***@***.***> Subject: Re: [Seji64/LAPS-WebUI] No permission to retrieve LAPS Password or no LAPS Password set! (Discussion #26) Does the DN or the OU where the computer is located has any special characters ? — Reply to this email directly, view it on GitHub<#26 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BHBTVVHC4BD76HZQEGFBZW3Z4DC5NAVCNFSM6AAAAABQFDAM66VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTAOJYGA3DMMQ>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[Seji64]

Hm okay. Do you mind to shtare more information about your environment?

• Docker or native?
• OS
• Is LAPS-WebUI and the domain controller located in different subnets?

[c-cuthbert]

Hi there, Running the Docker LAPS WebUI Testing from Windows 11 OS Different subnet to DC, although I have tested on same subnet, problem is still present. Regards, Christian From: Seji ***@***.***> Sent: Monday, 21 October 2024 7:16 PM To: Seji64/LAPS-WebUI ***@***.***> Cc: Cuthbert, Christian (NCMI, Hobart) ***@***.***>; Author ***@***.***> Subject: Re: [Seji64/LAPS-WebUI] No permission to retrieve LAPS Password or no LAPS Password set! (Discussion #26) Hm okay. Do you mind to shtare more information about your environment? * Docker or native? * OS * Is LAPS-WebUI and the domain controller located in different subnets? — Reply to this email directly, view it on GitHub<#26 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BHBTVVH4RWFP2LHOGWX2N3DZ4SZ47AVCNFSM6AAAAABQFDAM66VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCMBQGIZDEMI>. You are receiving this because you authored the thread.Message ID: ***@***.******@***.***>>

[dmurdoch7]

Hi there,

Just wondering if you received any update on this. I am getting this error as well and have delegated control for the user that queries the AD. Are there other permissions that are required for the user to work. I have installed LAPS Web UI on IIS and not locally.

Regards,
Darren

[Seji64]

Since Laps-WebUi brings its own web server, it is honestly not clear to me how you did it that it runs in the IIS. Any way: does the IIS run under a corresponding user who also has these delegated rights in the AD? Is Python with all required Modules installed?

[dmurdoch7]

To get it onto IIS I just opened the solution in Visual Studio 2022 and then published it to a folder. Gave it a hostname (https) and installed the python 3.13.x and I can log in and browse the computer list.

I stepped through the code and it looks like the LDAPService.cs file is not pulling all the attributes from AD (its only getting this on the line

LdapEntry? ldapSearchResult = (await ldapConnection.SearchAsync(defaultNamingContext, ldapFilter)).SingleOrDefault();

from the GetAdComputerAsync method but version 2 is looking for

string fieldName = (domain.Laps.EncryptionDisabled ? "msLAPS-Password" : "msLAPS-EncryptedPassword");

objectClass
cn
userCertificate
distinguishedName
instanceType
whenCreated
whenChanged
displayName
uSNCreated
uSNChanged
name
objectGUID
userAccountControl
badPwdCount
codePage
countryCode
badPasswordTime
lastLogoff
lastLogon
localPolicyFlags
pwdLastSet
primaryGroupID
objectSid
accountExpires
logonCount
sAMAccountName
sAMAccountType
operatingSystem
operatingSystemVersion
dNSHostName
servicePrincipalName
objectCategory
isCriticalSystemObject
dSCorePropagationData
lastLogonTimestamp
msDS-SupportedEncryptionTypes
msDS-KeyCredentialLink
msLAPS-PasswordExpirationTime

So not sure what to do there?

Regards,
Darren

[Seji64]

Check with powershell or ADUC if there is really a Laps Password present

[dmurdoch7]

@Seji64 Hey there, just wondering if you had any thoughts on my previous post? Regards, Darren

[raxmans]

Hi,
I got your tool working, nice job.
Would it be possible, to get it working on IIS?
Or how can I use it on https?
Thanks a lot

[Seji64]

Great you got it Running. Never deployed it myself to iis. For https I suggest a reverse proxy Like haproxy,nginx or caddy.