diff --git a/ATPDocs/security-assessment-laps.md b/ATPDocs/security-assessment-laps.md index 8eca283077..055a873e1f 100644 --- a/ATPDocs/security-assessment-laps.md +++ b/ATPDocs/security-assessment-laps.md @@ -13,9 +13,9 @@ Microsoft's "Local Administrator Password Solution" (LAPS) provides management o This security assessment supports [legacy Microsoft LAPS](https://www.microsoft.com/en-us/download/details.aspx?id=46899) and [Windows LAPS](/windows-server/identity/laps/laps-overview). -## What risk does not implement LAPS pose to an organization? +## What risks does not implementing LAPS pose to an organization? -LAPS provides a solution to the issue of using a common local account with an identical password on every computer in a domain. LAPS resolves this issue by setting a different, rotated random password for the common local administrator account on every computer in the domain. +LAPS provides a solution to the issue where customers are using a common local account with an identical password on every computer in a domain. LAPS resolves this issue by setting a different, rotated random password for the common local administrator account on every computer in the domain. LAPS simplifies password management while helping customers implement more recommended defenses against cyberattacks. In particular, the solution mitigates the risk of lateral escalation that results when customers use the same administrative local account and password combination on their computers. LAPS stores the password for each computer's local administrator account in AD, secured in a confidential attribute in the computer's corresponding AD object. The computer can update its own password data in AD, and domain administrators can grant read access to authorized users or groups, such as workstation helpdesk administrators.