tis-laps-by-wapt icon

LAPS by WAPT

Silent install package for LAPS by WAPT

3-15
Utilities
Utilities
Luti Build VirusTotal

tis-laps-by-wapt

This guide explains how to retrieve the local administrator password generated by the tis-laps-by-wapt package.

Instructions

Steps to Retrieve the Password

  1. Deploy the Package Install the tis-laps-by-wapt package on:

    • The target Organizational Unit (OU), or
    • The individual machines concerned.

  2. Access Audit Data

    • In the WAPT Console, select a machine where the tis-laps-by-wapt package is installed.
    • In the right panel, navigate to the « Audit Data » tab.

  3. Locate the LAPS Section

    • Find the row where the « Section » column contains the value « laps ».

  4. Identify the Password Key

    • The associated key is named « local_admin_password ».
    • If the « Decrypt Data » option is not checked, the displayed value will be encrypted in the following format: 
      -----BEGIN WAPT ENCRYPTION-----
{"XXXXXX"}
-----END WAPT ENCRYPTION-----

  5. Decrypt the Value

    • Check the « Decrypt Data » option to display the password in plaintext.
    • Condition: Your WAPT certificate must be correctly configured on the machine for decryption to work.

Important Notes

  • Decryption requires the WAPT certificate to be present and valid on the machine.
  • If the certificate is missing or invalid, the value will remain encrypted.

  • package: tis-laps-by-wapt
  • name: LAPS by WAPT
  • version: 3-15
  • categories: Utilities
  • maintainer: WAPT Team,Tranquil IT,Simon FONTENEAU,Amelie LE JEUNE,Pierre COSSON,Jimmy PELÉ, Kevin CHEREL
  • licence: wapt_public
  • locale: all
  • target_os: windows
  • architecture: all
  • signature_date:
  • size: 62.30 Ko

package           : tis-laps-by-wapt
version           : 3-15
architecture      : all
section           : base
priority          : optional
name              : LAPS by WAPT
categories        : Utilities
maintainer        : WAPT Team,Tranquil IT,Simon FONTENEAU,Amelie LE JEUNE,Pierre COSSON,Jimmy PELÉ, Kevin CHEREL
description       : Manages local Windows administrator account passwords, including the built-in Administrator account and the superadmin account. Generates random passwords and stores them in encrypted form in WAPT audit data.
depends           : 
conflicts         : 
maturity          : PROD
locale            : all
target_os         : windows
min_wapt_version  : 2.1
sources           : 
installed_size    : 
impacted_process  : 
description_fr    : Gère les mots de passe des comptes administrateurs locaux Windows, notamment le compte Administrateur intégré et le compte superadmin. Génère des mots de passe aléatoires et les stocke sous forme chiffrée dans les données d'audit WAPT.
description_pl    : Zarządza hasłami lokalnych kont administratorów systemu Windows, w tym wbudowanego konta Administrator i konta superadmin. Generuje losowe hasła i zapisuje je w postaci zaszyfrowanej w danych audytowych WAPT.
description_de    : Verwaltet die Passwörter lokaler Windows-Administratorkonten, einschließlich des integrierten Administratorkontos und des Kontos superadmin. Generiert zufällige Passwörter und speichert sie verschlüsselt in den WAPT-Auditdaten.
description_es    : Gestiona las contraseñas de las cuentas de administrador local de Windows, incluidas la cuenta Administrador integrada y la cuenta superadmin. Genera contraseñas aleatorias y las almacena cifradas en los datos de auditoría de WAPT.
description_pt    : Gere as palavras-passe das contas de administrador local do Windows, incluindo a conta de Administrador integrada e a conta superadmin. Gera palavras-passe aleatórias e armazena-as de forma encriptada nos dados de auditoria do WAPT.
description_it    : Gestisce le password degli account amministratore locali di Windows, inclusi l'account Administrator integrato e l'account superadmin. Genera password casuali e le memorizza in forma crittografata nei dati di audit di WAPT.
description_nl    : Beheert de wachtwoorden van lokale Windows-beheerdersaccounts, waaronder het ingebouwde Administrator-account en het superadmin-account. Genereert willekeurige wachtwoorden en slaat deze versleuteld op in de WAPT-auditgegevens.
description_ru    : Управляет паролями локальных учетных записей администраторов Windows, включая встроенную учетную запись Administrator и учетную запись superadmin. Генерирует случайные пароли и сохраняет их в зашифрованном виде в данных аудита WAPT.
audit_schedule    : 
editor            : 
keywords          : 
licence           : wapt_public
homepage          : 
package_uuid      : 769c0b96-4d29-4728-85ba-98625739778b
valid_from        : 
valid_until       : 
forced_install_on : 
changelog         : 
min_os_version    : 
max_os_version    : 
icon_sha256sum    : 3ff6547ef5ca3bd871b4ae07f6ae9060009646db2baac829120c87c285ead18b
signer            : Tranquil IT
signer_fingerprint: 8c5127a75392be9cc9afd0dbae1222a673072c308c14d88ab246e23832e8c6bb
signature_date    : 2026-10-22T11:00:20.000000
signed_attributes : package,version,architecture,section,priority,name,categories,maintainer,description,depends,conflicts,maturity,locale,target_os,min_wapt_version,sources,installed_size,impacted_process,description_fr,description_pl,description_de,description_es,description_pt,description_it,description_nl,description_ru,audit_schedule,editor,keywords,licence,homepage,package_uuid,valid_from,valid_until,forced_install_on,changelog,min_os_version,max_os_version,icon_sha256sum,signer,signer_fingerprint,signature_date,signed_attributes
signature         : AzXwMtG7FswCwPa/F79qd9C9mmo5SzwnpQ4jds6EfyhzEbSt/2mJnyCIaoBPEjl5+bQTaCjrGmQ6Lx394joMEvbcrHq/QhYcw2IWiIQnVeozcj/qyc1hHEYMZbjINomM/EVbG1et35kWgPHnJH3n6eWF2zJS/u0YkTvQzr7fIW45LoWq6AUhcSu0sVU77ZjzfNOR1Op6dcoFQKMUzzYux/Who/Eme45mwqByD9XuIhgHuuzTGo9+zVFjxVfR7jySqI9+hoW36d7mWBSy4T0PCEMD/zOXVC9a62vwNuTC9swNifchGgnoqEDiOuFNlXu/GbcClXbVH23YoWBIOmLBzQ==

# -*- coding: utf-8 -*-
from setuphelpers import *
import win32net
import win32security
import datetime
import secrets

try:
    import waptcrypto
    if "encrypted_data_str" in dir(waptcrypto):
        from waptcrypto import encrypted_data_str as rsa_encrypted_data_str
except:
    pass

# dict_admin = {
#     "en": "administrator",
#     "fr": "administrateur",
#     "de": "administrator",
#     "pl": "administrator",
#     "es": "Administrador",
#     "pt": "administrador",
#     "it": "administrator",
#     "nl": "administrator",
#     "ru": "Администратор",
# }

def install():
    # Copie des certificats nécessaires au déchiffrement des données d'audit
    for crt in glob.glob("*.crt"):
        filecopyto(crt, makepath(WAPT.wapt_base_dir, "ssl", crt))
    filecopyto("eff_large_wordlist.txt", persistent_dir)
    audit()


def audit():
    # Chargement de la liste de mots pour générer les mots de passe
    with open(makepath(persistent_dir, "eff_large_wordlist.txt")) as f:
        words = [line.split("\t")[1].strip() for line in f]

    # Recherche de l'Administrateur intégré (SID -500)
    locsid = str(win32net.NetUserModalsGet(get_computername(), 2)["domain_id"]).split(":", 1)[-1]

    sid = win32security.GetBinarySid(locsid + "-500")
    admin_local_user, domain, typ = win32security.LookupAccountSid(wincomputername(), sid)

    # Liste des comptes à gérer
    admin_users = [(admin_local_user, "local_admin_password"),]

    # Ajout de superadmin s'il existe
    try:
        win32net.NetUserGetInfo(None, "superadmin", 0)
        if admin_local_user.lower() != "superadmin":
            admin_users.append(("superadmin", "superadmin_password"))
    except:
        pass

    # Renouvellement indépendant du mot de passe de chaque compte
    for username, audit_key in admin_users:
        update_password(username, audit_key, words)
    return "OK"


def update_password(username, audit_key, words):
    # Récupération de la date du dernier audit pour ce compte
    all_passwords = list(WAPT.read_audit_data_set("laps", audit_key))

    if all_passwords:
        raw_last_date = all_passwords[-1][1]
    else:
        raw_last_date = None

    # Sécurisation de la date
    if not raw_last_date or "T" not in str(raw_last_date):
        last_date = "1970-01-01T00:00:00"
    else:
        last_date = str(raw_last_date).rstrip("Z")

    now_naive = datetime.datetime.now(datetime.timezone.utc).replace(tzinfo=None)

    try:
        last_date_parsed = isodate2datetime(last_date).replace(tzinfo=None)
    except:
        last_date_parsed = datetime.datetime(1970, 1, 1)

    # Renouvellement si aucune donnée n'existe, si elle date de plus d'un an,
    # ou si le renouvellement forcé est demandé
    if (not raw_last_date or now_naive - last_date_parsed > datetime.timedelta(days=365) or force):
        passphrase = generate_passphrase(words)

        # En dehors d'une installation LUTI, modification effective du mot de passe
        if not params.get("install_with_luti", False):
            run(r'net user "%s" "%s"' % (username, passphrase))

        # Activation du compte
        run(r'net user "%s" /active:yes' % username)

        # Enregistrement chiffré du mot de passe dans l'audit WAPT
        WAPT.write_audit_data_if_changed("laps",audit_key,rsa_encrypted_data_str(passphrase, [WAPT.public_certs_dir]),max_count=3)

def generate_passphrase(word_list, num_words=4):
    parts = [secrets.choice(word_list).capitalize() + str(secrets.randbelow(10)) for _ in range(num_words)]
    return "-".join(parts)

1a6b620f00f4030e18b8bf199de1987bae82e8b57541750886298ac42393ddc6 : WAPT/README.md
424412f5866d0050bf46967f2f3aefedbf1de50d6821f719b20fcc4e5d85e214 : WAPT/README_fr.md
38d056ab130f7bf7c481c12636a4e9959de36561d3dfcbe54c6e3571bc0c1dc3 : WAPT/certificate.crt
d33cacf8ee5d3daa6737e352ece03cd0d26bd70a35c878d166872418eae058a9 : WAPT/control
3ff6547ef5ca3bd871b4ae07f6ae9060009646db2baac829120c87c285ead18b : WAPT/icon.png
ce144bbfd1dbaa823492d7df1f0c50c18eb89ce68008277b60fe28f199de0234 : eff_large_wordlist.txt
ed485bdb8c73f54dde2246a8af71dd3f8de78f2b33198fd81d87af789ea5393d : luti.json
ddd96bc61608a57af10a308e8a1d89a751e80c5a7ba6eaacd23e599e2fbbc070 : setup.py