64. AD remediation: tiered admin model, Windows LAPS, hygiene

The AD assessment page finds what is wrong with a domain (14.5). Its Remediate tab fixes it. Every fix is a staged action:

1. Preview. Lawliet computes, from the domain's latest collection, exactly which objects change and how, what it will refuse to touch and why, and who would be affected. Nothing changes in AD.
2. Apply. A second administrator approves (four-eyes, Write to Active Directory). The Lawliet agent on a domain controller then, for every object: reads its current state (the backup), checks it still matches the preview (an object that changed since is skipped, not forced), changes it, and reads it back.
3. Verify. Re-reads everything the action changed and compares it with what the apply left. Audit-mode actions also collect their evidence here (event logs).
4. Roll back. One click, approved by a second administrator. Lawliet puts back exactly what the backup recorded, newest change first, then re-reads every object and reports, per object, whether it now equals its state before the apply (restored exactly) or how it differs.

The approval binds the preview. The apply request carries the digest of the exact preview you saw (and the approver sees); if the preview is different, the apply is refused.

Lawliet's own accounts are never touched by any of these actions: the directory bind account (directory sign-in, sync, collection), every remote-deployment credential's username, and lawliet-recovery. Well-known service accounts (Entra Connect MSOL_*, AAD_*, Sync_*, AZUREADSSOACC$) are left alone too, and the agent skips a managed service account (gMSA/sMSA) it meets.

The Lawliet server never writes to AD and holds no AD credentials: the agent on the domain controller does the work, as the local SYSTEM account, through a closed list of directory operations. A preview is tied to its collection: when the domain is collected again, preview again.

You need: a completed collection of the domain (14.5), the Lawliet agent on one of its domain controllers, and the permission Write to Active Directory. Viewing or rotating a LAPS password needs View and rotate LAPS passwords. The schema extension needs Extend the Active Directory schema.

64.1 The Remediate tab#

AD assessment > (choose the domain) > Remediate. The left column lists the actions in three groups; the form for the chosen one is on the right, with Preview (or Check now for the read-only LAPS check). Below, Actions lists every action of the domain, newest first:

A refusal (red) means Lawliet will not apply the action as asked. A warning (amber) is something you should know before you approve.

64.2 Tiered admin model#

Procedure: create (or adopt) the tier OUs and groups#

1. Remediate > Tier OUs and admin groups > Preview.
2. Lawliet looks for existing tier OUs (Tier 0, T0, Tier0 ...) and groups (Tier 0 Admins, T1-Admins ...). What exists is adopted and never changed; the rest is listed as create: OU=Admin with OU=Tier 0/1/2 under it (protected from accidental deletion), and a global security group Tier N Admins in each.
3. Apply, have it approved, then collect the domain again so the new groups' SIDs are known.
4. Put your administrators into the tier groups (Lawliet does not choose people for you).

Rollback deletes only the OUs and groups this action created, and only while they are empty: an OU you have put objects in, or a group you have added members to, is left in place and the result says so.

Procedure: logon restrictions, audit first#

1. Remediate > Tier logon restrictions. Choose the Tier 1 (server) OUs and Tier 2 (workstation) OUs; optionally extra Tier 0 server OUs (the Domain Controllers OU is always Tier 0). Also deny access from the network is off by default.
2. Preview. For each tier the table shows the hosts, the accounts that would be refused there and the rights: Deny log on locally, through Remote Desktop, as a batch job, as a service:
   • Tier 0 hosts refuse Tier 1 and Tier 2 administrators;
   • Tier 1 hosts refuse Tier 0 (Tier 0 Admins, Domain Admins, Enterprise Admins, Schema Admins) and Tier 2;
   • Tier 2 hosts refuse Tier 0 and Tier 1. BUILTIN groups are never denied (on a member server BUILTIN\Administrators is that host's own group).
3. Refusals: an OU containing a domain controller or the Domain Controllers OU; overlapping OUs; a missing Tier 1/Tier 2 group; one of Lawliet's own accounts in a denied group while deny access from the network is on (otherwise a warning); and the lockout guard - every enabled Tier 0 administrator is also in a lower tier (enforcing would lock them all out of the domain controllers). Warnings name accounts in two tiers at once and Tier 0 accounts with a service on a lower-tier host (deny service logon would stop it).
4. Apply (audit). Lawliet creates one GPO per tier (Lawliet Tier N logon restrictions) with the deny rights and links it disabled: nothing is refused yet.
5. Wait, then Verify. Lawliet reads the domain controller's Kerberos service-ticket log (event 4769, last 7 days) and lists the account/host pairs that would have been refused.
6. Preview enforce on the audit action. Enforce needs audit evidence collected by a Verify at least 24 hours after the audit was applied (AD_ADMIN_MIN_AUDIT_HOURS in the server's .env); without it the preview is refused. The enforce preview recomputes everything on the latest collection with the audit's OUs: the lockout guards run again, and accounts refused now but not in the audit's preview (group membership changed since) are listed; those the audit never saw using these hosts are flagged no usage evidence. Apply: the links are enabled. Hosts apply it at their next policy refresh.

Rollback of enforce disables the links again (back to audit); rollback of the audit action removes the links and deletes the GPOs.

64.3 Windows LAPS#

Windows LAPS is built into Windows 11, Windows 10 and Windows Server 2019/2022/2025 (from the April 2023 update). Windows Server 2016 and older cannot run it.

Procedure: check the prerequisites#

Remediate > LAPS prerequisites > Check now. Read-only, no approval. The result lists: the Windows LAPS PowerShell module on the domain controller, whether the schema has the Windows LAPS attributes, the domain functional level (2016 or higher for encrypted passwords), a legacy Microsoft LAPS schema, and how many hosts can run Windows LAPS (supported / need the update / cannot / unknown). It also reads the domain's maximum password age and whether the AD Recycle Bin is on (used by the hygiene actions).

If the domain controller has no Windows LAPS module, the check, the schema extension, Enable and view/rotate all say so in one line: Windows LAPS is not available on this domain controller: install the April 2023 or later cumulative update (Windows Server 2019 or later). Install the update on the domain controller with the agent, then check again.

Procedure: extend the schema (irreversible)#

1. Remediate > LAPS schema extension > Preview. Refused if the schema already has the attributes or the domain controller has no LAPS module.
2. Tick I understand this can never be undone, then Apply. This is its own critical action, Extend the Active Directory schema, separate from other AD writes, so it is approved on its own.
3. The agent runs Update-LapsADSchema. It needs Schema Admins rights; if the directory refuses the agent's account, the result says so and nothing changed.

There is no rollback: a schema extension is permanent.

Procedure: enable Windows LAPS for OUs#

1. Remediate > Enable Windows LAPS. Choose the OUs of computers, the groups that may read the passwords (Domain Admins always can), password age, length, complexity and, optionally, the managed account name.
2. Preview lists each OU's permissions change, the GPO settings, and the hosts that cannot run Windows LAPS. Refused before the schema is extended, and for the Domain Controllers OU.
3. Apply. Lawliet records each OU's permissions, grants computers the right to write their own password (Set-LapsADComputerSelfPermission) and the reader groups the right to read it (Set-LapsADReadPasswordPermission), then creates Lawliet Windows LAPS (back up to AD, the age, length and complexity you chose, encryption on at functional level 2016+) and links it to the OUs.

Rollback unlinks and deletes the GPO and puts back each OU's permissions, per account or group (trustee): for every trustee whose entries Lawliet's change touched, the entries it has now must be exactly the ones Lawliet left; they are replaced by the ones recorded before (an entry Windows merged is put back as it was). Entries of every other trustee stay as they are, later changes included: the rollback is then done, shown as not exact with "other trustees' later entries kept". Restored entries go back in canonical order. If someone changed a touched trustee's entries after the apply, that step is refused, nothing is guessed, and the action shows the permissions on <OU> changed since Lawliet's change; tick Overwrite the changes and Roll back again (a second administrator approves the overwrite) to put back the recorded entries. The second rollback sends only the steps the first one did not put back. Hosts keep the last password LAPS set: rotate or note it before rolling back if you will need it.

Procedure: view or rotate a computer's password#

1. Remediate > Local administrator password (Windows LAPS): type the computer name.
2. Read as: an encrypted LAPS password (the default at functional level 2016+) can be read only by its authorized decryptor, Domain Admins unless the policy names another group. The domain controller agent runs as SYSTEM, which is not one. Choose a stored Windows credential (Fleet > Remote deployment, kind WinRM password) of a member of that group; it travels sealed in the signed task and is dropped from the server once the request ends. Reading as a stored credential also needs Deploy agents remotely (the permission to use stored credentials); a sandbox credential is never used on a real domain. Without one, an encrypted password is not shown and the result names the group that can read it (use Get-LapsADPassword or the LAPS tab in Active Directory Users and Computers as one of them).
3. View once. Your browser makes a key pair whose private half never leaves the tab; the domain controller encrypts the password to the public half. The Lawliet server only relays the ciphertext, hands it out once and then deletes it (a password nobody fetches is deleted after 10 minutes). It is shown for 60 seconds with a copy button. Needs the console over HTTPS (or on localhost); on plain HTTP the button explains this.
4. Rotate. The domain controller expires the password now; the host sets a new one at its next policy check (about 90 minutes, or gpupdate). When the host has a Lawliet agent, it runs Reset-LapsPassword at once (only a host of this domain, matched by its domain name) and the console says Rotated now on the host.

Every view and rotation is in the audit log (laps_password_view, laps_password_rotate) with the computer name. Domain controllers are refused (their DSRM password is out of scope).

64.4 Hygiene#

A stale account that logs on between the preview and the apply is skipped: the agent re-reads its last logon first.

Procedure: LDAP signing and channel binding#

1. Remediate > LDAP signing and channel binding > Preview (audit), Apply. Lawliet creates Lawliet LDAP signing (domain controllers) linked to the Domain Controllers OU: LDAP interface event logging level 2 and channel binding when supported (clients that cannot do it still bind). It also records the agent DC's own values.
2. After a few days, Verify: Lawliet collects events 2889 (unsigned binds, with client address and account), 2887 (daily count), 3039 and 3040 (binds without channel binding).
3. Preview enforce: LDAP server signing required and channel binding always. Refused without audit evidence collected at least 24 hours after the audit was applied (the 2887/3040 summaries are daily); refused while the audit saw unsigned binds or binds without channel binding, unless you confirm the clients may break; and refused while Lawliet's own directory connection is plain LDAP (a simple bind on 389 would break: switch it to LDAPS, StartTLS or sealed LDAP first). With sealed LDAP, LDAPS or StartTLS the preview notes that Lawliet's own connection is not affected.
4. Apply enforce.

Rollback of enforce writes the audit values back. Rollback of the audit writes the previous (or default) values into the GPO so every domain controller returns to them, and puts the agent DC's registry back exactly. The GPO is kept on purpose: deleting it would leave the new values on DCs that already applied it. Delete it in Group Policy Management once every DC has refreshed policy. With several DCs, events and the registry snapshot come from the DC with the agent only.

64.5 What the results mean#

• Skipped (amber): the object changed since the preview (logged on, moved, already fixed). Nothing was done to it.
• Failed (red): the directory refused (for example access denied). The detail is the directory's message.
• Applied with a failed step shows as partial; roll back undoes only what was done.
• Restored exactly: the object re-read after the rollback equals its backup. Anything else is listed as differs with the fields.
• A rollback that takes away the last GPO link of an OU clears its gPLink attribute, so an OU that had no link before has none again (Windows would otherwise leave a blank value).
• If the domain controller agent stops answering during an apply, the action becomes failed with the directory may be partly changed: run Verify after the agent is back.

64.6 Sandbox#

With the sandbox licence, the sandbox domain corp.local shows actions at every stage (a prerequisite check, tiers created, logon restrictions in audit with evidence, quarantined accounts, a rolled-back removal, an LDAP audit waiting for approval). They are computed by the product on the sandbox collection; nothing is sent to an agent, and Clear demo data removes them.

64.7 Lab and test settings#

Two waits protect production and make a lab proof slow. Both are server settings in .env (restart the backend after a change). Keep the defaults in production.

While either value is below its default, the Remediate tab shows Lab setting active: evidence window 1 h (normal 24 h) or Lab setting active: quarantine minimum 0 days (normal 7), every affected preview (tier logon and LDAP signing audit and enforce, delete quarantined accounts) lists it first among its warnings, and the four-eyes approval request names it, so a value left over from a lab proof cannot go unnoticed. AD_ADMIN_MIN_AUDIT_HOURS of 0 or less refuses every audit and enforce preview with that message; the console's day field uses the server's quarantine minimum.