I'm in the process of migrating from legacy LAPS to the new integrated version of LAPS. Everything seems fine so far—our Domain functional level is good, and I've run the necessary AD schema preparation and Update-LapsADSchema -verbose, ensuring I've allowed time for replication. I've also executed the required commands on our test OU, and the LAPS tab for our machine is populating as expected. We're able to log in with the LAPS user and password without issues. However, I noticed an error in the event logs stating: 'The msLAPSCurrentPasswordVersion attribute has not been added to the Active Directory schema...' While LAPS appears to function normally, I would really like to resolve this error. Has anyone experienced this issue and found a solution?
3 Answers
I’ve read that this might be tied to functionality in Server 2025. Are you using an upgraded account that has the necessary permissions? Also, I found several discussions online about the msLAPSCurrentPasswordVersion attribute missing—might want to check those out for more insights.
Yeah, definitely keep an eye on that upgrade! Meanwhile, it's good to hear LAPS is still functioning smoothly for you!
We had a similar issue and found that running the Update-LapsADSchema cmdlet from a machine running Windows 11 24H2 did the trick for us. It created the missing attribute right away!
Thanks for the advice! I ran it from a Windows 11 machine just like you suggested, and it worked!
Just throwing this out there—make sure you have the .admx files installed on your Domain Controller. I needed them to get the new LAPS running without any hitches when I set it up.
I think you're onto something! We only run 2022 domain controllers, so that might be affecting us. The account has all the right permissions, so I guess we'll just wait until we upgrade to 2025 to run the update again.