# Integrating Microsoft LAPS and ansible

**URL:** <https://forum.ansible.com/t/integrating-microsoft-laps-and-ansible/33359>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [July 9, 2020, 10:52am UTC](https://forum.ansible.com/t/integrating-microsoft-laps-and-ansible/33359 "2020-07-09T10:52:05Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![harsh\_chawda](https://avatars.discourse-cdn.com/v4/letter/h/4491bb/32.png) [@harsh\_chawda](https://forum.ansible.com/u/harsh_chawda)\
**Post date:** [July 9, 2020, 10:52am UTC](https://forum.ansible.com/t/integrating-microsoft-laps-and-ansible/33359/1 "2020-07-09T10:52:05Z")

</div>

Hello All,

I am using ansible for patching windows machines in my domain. The process is working fine with patches being installed till date over Winrm and kerberos as authentication.

But now they have decided to use LAPS in the environment .So, the password keep on changing and i am not able to access with the same password and patch the servers.

So, i tried researching on the internet about it and how to integrate it with the current setup.But I am not able to do it.

Is it feasible and possible with ansible to use LAPS to retrieve password and patch windows machines as I am patching 5-10 machines at a stretch and all are having different passwords. And also is it secure to integrate it with ansible

If anyone have used it in their environment and help me out in this ,it would be great. As, I am completely blank on this and how to integrate it.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [July 13, 2020, 7:42pm UTC](https://forum.ansible.com/t/integrating-microsoft-laps-and-ansible/33359/2 "2020-07-13T19:42:56Z")

</div>

Theres the laps\_password [https://docs.ansible.com/ansible/latest/plugins/lookup/laps\_password.html](https://docs.ansible.com/ansible/latest/plugins/lookup/laps_password.html) lookup that you can use to retrieve a password set by LAPS from AD. Unfortunately it requires a few extra bits to be installed on your host like OpenLDAP but it’s definitely possible.

---

<div class="post-metadata">

**Author:** ![harsh\_chawda](https://avatars.discourse-cdn.com/v4/letter/h/4491bb/32.png) [@harsh\_chawda](https://forum.ansible.com/u/harsh_chawda)\
**Post date:** [July 15, 2020, 10:47am UTC](https://forum.ansible.com/t/integrating-microsoft-laps-and-ansible/33359/3 "2020-07-15T10:47:53Z")

</div>

Hello ,

Thanks for you reply. I will test it out the same.

Thanks again.

---

<div class="post-metadata">

**Author:** ![harsh\_chawda](https://avatars.discourse-cdn.com/v4/letter/h/4491bb/32.png) [@harsh\_chawda](https://forum.ansible.com/u/harsh_chawda)\
**Post date:** [July 15, 2020, 11:33am UTC](https://forum.ansible.com/t/integrating-microsoft-laps-and-ansible/33359/4 "2020-07-15T11:33:26Z")

</div>

Hello,

I have one doubt like not all systems in my environment are configured with LAPS as of now.

So some of the systems are having LAPS others are having LDAP . So will both the things work out.

ie. basically if i install OpenLDAP , is it standalone package/module or will it replace the current configuration settings. ie. LDAP

Thanks for your reply.

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [July 15, 2020, 6:42pm UTC](https://forum.ansible.com/t/integrating-microsoft-laps-and-ansible/33359/5 "2020-07-15T18:42:20Z")

</div>

I don’t understand what you mean sorry. OpenLDAP is required on the controller because that’s a dependency of python-ldap that the lookup uses [https://www.python-ldap.org/en/python-ldap-3.3.0/installing.html#installing](https://www.python-ldap.org/en/python-ldap-3.3.0/installing.html#installing). If you already have it installed then you don’t need to reinstall it.

If some hosts use LAPS then you can use this for plugin to get the password, for the others that don’t then you need some other mechanism to get the password.

---

<div class="post-metadata">

**Author:** ![harsh\_chawda](https://avatars.discourse-cdn.com/v4/letter/h/4491bb/32.png) [@harsh\_chawda](https://forum.ansible.com/u/harsh_chawda)\
**Post date:** [July 22, 2020, 5:41am UTC](https://forum.ansible.com/t/integrating-microsoft-laps-and-ansible/33359/6 "2020-07-22T05:41:45Z")

</div>

Hello Jordan,

Thanks for your reply .

I am trying to do the same what you explained. Will post my queries if got any issues.

Thanks again.