What you’re seeing
- The LAPS tab on a computer object shows that a password exists but will not display it.
- Retrieving the local admin password returns an access-denied or decryption error.
- Some admins can read LAPS passwords while others with similar roles cannot.
- The problem started after enabling LAPS password encryption.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- Encrypted Windows LAPS passwords can be decrypted only by members of a specifically authorized group, and the admin is not in it.
- The authorized decryptor group was configured as Domain Admins by default and never broadened to the support team.
- The admin has read permission on the attribute but not decryption rights, which are separate.
- The admin's group membership change has not applied to their current logon session.
- The domain functional level or domain controller versions do not support encrypted passwords for this scenario.
Why it matters
LAPS exists so that every PC has a unique, rotating local admin password. If technicians can't read it, they cannot help a user locked out of a domain-broken PC or troubleshoot offline machines. That pressure often leads to reusing a shared local admin password again, undoing the main security benefit LAPS provides and reopening the door to lateral movement in an attack.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Is the password missing or just hidden?
Usually it is stored and rotating correctly; the reader simply lacks rights to decrypt it. We confirm both before making changes.
Who should be allowed to read these passwords?
Only the people who genuinely support those machines. We help you choose a narrowly scoped group rather than opening access to all administrators.