# LAPS

### Using CrackMapExec when LAPS installed on the domain

If LAPS is used inside the domain, is can be hard to use CrackMapExec to execute a command on every computer on the domain.

Therefore, a new core option has been added `--laps !` If you have compromised an accout that can read LAPS password you can use CrackMapExec like this

`crackmapexec winrm <ip> -u user-can-read-laps -p pass --laps`

<figure><img src="https://3800235601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fx4pJgNiBOMLG3QHRPFAy%2Fuploads%2FcN2sxsu1KCUOE91iCeGg%2Fimage.png?alt=media&#x26;token=c6cd7347-d8ab-40c0-b7bd-4069d72a6afa" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
If the default administrator name is not administrator add the user after the option

`--laps name`
{% endhint %}
