Workplace Security Standardization: Implementing LAPS and Centralized Software Management

Project Description:

The client faced significant security challenges and chaotic management of their computer fleet. The same local administrator password was used on all workstations, creating a critical vulnerability (risk of rapid ransomware spread). Additionally, software installation was performed manually, consuming substantial IT department time and leading to inconsistent software versions. SVC Service implemented a project to deploy Microsoft LAPS and automate software deployment.

Implemented Tasks:

• Active Directory Audit: Review of the Organizational Unit (OU) structure and the status of computer accounts.
• Microsoft LAPS Implementation:
  • Extended the Active Directory schema to support LAPS attributes.
  • Configured Group Policies (GPO) for automatic generation of unique, complex local administrator passwords for each PC.
  • Configured access permissions: passwords are visible only to authorized system administrators.
  • Automated deployment of the Client-Side Extension (CSE) to all domain computers.
• Software Deployment Automation:
  • Created a centralized repository for installation packages (MSI).
  • Configured GPOs for automatic installation of a core software suite (browsers, archivers, office applications) and department-specific software.
  • Implemented a mechanism for automatic updates of critical software without user intervention.
• Security Hardening: Disabled local administrator rights for standard users, minimizing the risk of malware installation.

Tools Used:

• Windows Server (Active Directory Domain Services)
• Group Policy Management (GPO)
• Microsoft LAPS (Local Administrator Password Solution)
• PowerShell (for automation and audit scripts)
• MSI packages (Google Chrome, 7-Zip, Adobe Reader, etc.)

Project Results:

• Eliminated Lateral Movement Threat: Thanks to unique passwords on each PC, attackers or viruses cannot use one stolen credential to access other computers on the network.
• IT Department Time Savings: New workstation setup time reduced from 2 hours to 20 minutes (PC automatically receives all necessary software upon joining the domain).
• Infrastructure Standardization: All employees now have identical, up-to-date versions of software.
• Regained Control: Full control over workstation access permissions has been restored.

The client received a secure and manageable environment that meets modern information security standards.

This case study demonstrates SVC Service's expertise in configuring corporate networks based on Microsoft technologies, ensuring a balance between stringent security and administrative convenience.