# Password Expiration Protection

One of the LAPS policy settings is called "Do not allow password expiration time longer than required by policy". In short, this is the *PwdExpirationProtectionEnabled* \*\*\*\* configuration that we read from the Registry.pol file. When enabled, this policy prevents a user or computer setting the expiration date of a password beyond the password age specified in the *PasswordAgeDays* setting. We also read from Registry.pol that this is set to 30 days. For instance - if a password is set on 1st January 2022, its expiration will be 31st January 2022. If password expiration protection is enabled and we attempted to modify its expiration date beyond 31st January, it would trigger an automatic reset of that password.

If the policy setting is left "not configured" in the GPO, then password expiration protection is disabled by default.

Since we were able to compromise WKSTN-1 using its LAPS password, we can set its expiration long into the future as a form of persistence. The expiration date is an 18-digit timestamp calculated as the number of 100-nanosecond intervals that have elapsed since 1st January 1601 (don't ask).

```
beacon> powershell Get-DomainComputer -Identity wkstn-1 -Properties ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime

ms-mcs-admpwdexpirationtime ms-mcs-admpwd 
--------------------------- ------------- 
         133101494718702551 1N3FyjJR5L18za
```

\\

Where `133101494718702551` is Thursday, 13 October 2022 15:44:31 GMT.

<https://www.epochconverter.com/ldap> can translate between these timestamps and human-readable formats.

\\

If we wanted to push the expiry out by 10 years, we can overwrite this value with `136257686710000000`. Every computer has delegated access to write to this password field, so we must elevate to SYSTEM on WKSTN-1.

```
beacon> run hostname
wkstn-1

beacon> getuid
[*] You are NT AUTHORITY\SYSTEM (admin)

beacon> powershell Set-DomainObject -Identity wkstn-1 -Set @{'ms-Mcs-AdmPwdExpirationTime' = '136257686710000000'} -Verbose
Setting 'ms-Mcs-AdmPwdExpirationTime' to '136257686710000000' for object 'WKSTN-1$'
```

**OPSEC**\
\
The expiration date will still be visible to admins and a manual reset will change the password and restore the expiration date.\
\
![](https://files.cdn.thinkific.com/file_uploads/584845/images/411/f2f/065/laps-ui.png)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://yamortsa.gitbook.io/rto/local-administrator-password-solution/password-expiration-protection.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.