LAPS-WebUI

Features

🔐

LAPS v1 & v2 Support

Full support for both legacy LAPS v1 and modern LAPS v2, including encrypted password decryption via Kerberos and DCE-RPC.

🏢

Multi-Domain

Connect to multiple Active Directory domains from a single instance. Switch between domains seamlessly.

🔑

AD Authentication

No separate user management needed — access is fully controlled by Active Directory permissions. Authenticate directly against your domain controllers.

🐳

Docker Deployment

One-line Docker deployment with full environment variable configuration. Bare-metal deployment also supported.

📋

Password History

View historical LAPS passwords for LAPS v2, with account names and timestamps. Track password rotation events.

🌙

Dark Mode

Built-in dark/light theme toggle. MudBlazor-powered Material Design components for a clean, modern interface.

Docker Quick Start

Running LAPS-WebUI in Docker is straightforward. Replace the example values with your own environment:

docker run -d \
  --name=lapswebui \
  -e Domains__0__Name=example.com \
  -e Domains__0__Ldap__Server=ldap.example.com \
  -e Domains__0__Ldap__Port=636 \
  -e Domains__0__Ldap__UseSSL=true \
  -e Domains__0__Ldap__TrustAllCertificates=true \
  -e Domains__0__Ldap__SearchBase='DC=example,DC=com' \
  -p 8080:8080 \
  --restart unless-stopped \
  ghcr.io/seji64/laps-webui:latest

Access the app at http://localhost:8080.

Requirements

✓ Active Directory with Microsoft LAPS installed
✓ .NET 10 runtime (bare metal) or a Docker host
✓ Python 3 with dpapi-ng[kerberos] (for LAPS v2 encrypted password decryption)
✓ Network access to domain controllers (LDAP + DCE-RPC for LAPS v2)

Configuration

Configure your domains via appsettings.json or environment variables. Here's an example configuration:

{
  "Domains": [
    {
      "Name": "example.com",
      "Ldap": {
        "Server": "ldap.example.com",
        "Port": 636,
        "UseSSL": true,
        "TrustAllCertificates": true,
        "SearchBase": "OU=Clients,DC=example,DC=com"
      },
      "Laps": {
        "ForceVersion": "All",
        "EncryptionDisabled": false
      }
    }
  ]
}

See appsettings.json.example for the complete reference.

Security

✓ AD credentials stay on the server — the browser only holds a random session ID
✓ Sessions end after inactivity (default 60 min), after a maximum lifetime (default 8 h) and on logout
✓ Optional login rate limiting per client IP against password guessing and mass AD lockouts
✓ Content-Security-Policy and security headers on every response
✓ Audit log for logins, password retrievals and password resets

Session timeout and login rate limiting

Both are configured in appsettings.json or via environment variables (e.g. Session__IdleTimeoutMinutes, LoginRateLimit__Enabled). Login rate limiting is off by default:

{
  "Session": {
    "IdleTimeoutMinutes": 60,
    "LifetimeMinutes": 480
  },
  "LoginRateLimit": {
    "Enabled": true,
    "MaxFailedAttempts": 10,
    "WindowMinutes": 15
  }
}

Behind a reverse proxy, set ASPNETCORE_FORWARDEDHEADERS_ENABLED=true so the app sees the real client IP. Otherwise all users share the proxy's IP and therefore one limit.