Windows LAPS in Get-ADReplAccount / Get-ADDBAccount Empty

[SimonSixty]

I just tested DSInternals Version 5.3 and tried to get the Windows LAPS Encrypted DSRM Password on Windows Server 2025 from the NTDS DB but it doesn't show up in the outputs.

Are the DSRM Passwords not supported yet or is it an issue? I will try normal "lokal admin" passwords now.

Get-ADDBAccount -BootKey $bootkey -SamAccountName xx-vdc02$ -DatabasePath C:\Temp\NTDS\ntds.dit

LastLogonDate: 24.04.2025 11:30:58
PasswordLastSet: 24.04.2025 11:40:01
SecurityDescriptor: DiscretionaryAclPresent, SystemAclPresent, DiscretionaryAclAutoInherited, SystemAclAutoInherited, SelfRelative
LAPS
Key Credentials
Secrets
NTHash: 3dfc8164a413057d1e0f0d6238e44429
...

[MichaelGrafnetter]

Hi @SimonSixty , encrypted LAPS passwords are currently work in progress. Only unencrypted Windows LAPS and Legacy LAPS passwords are supported in version 5.3.

[SimonSixty]

Thank you so much for your quick respond @MichaelGrafnetter im looking forward to that in the future! thanks for your great work!