Reading a Windows LAPS password with PowerShell

Short answer Use Get-LapsADPassword for Windows LAPS and Get-ADComputer for legacy AdmPwd. The identity must be the computer-object name in Active Directory.

Identify the LAPS version first

Windows LAPS: The password is normally stored in msLAPS-Password and managed with the LAPS PowerShell module.
Legacy Microsoft LAPS: Uses the ms-Mcs-AdmPwd attribute.

Read a Windows LAPS password

# Windows LAPS
Get-LapsADPassword -Identity "CLIENT01" -AsPlainText |
Select-Object ComputerName, Account, Password, ExpirationTimestamp

Expected output

The computer name, managed local account, password and expiration time are returned. An empty Password field usually means missing read permission or that the device has not backed up a password yet.

If legacy LAPS is in use

# Eski Microsoft LAPS (AdmPwd)
Get-ADComputer "CLIENT01" -Properties ms-Mcs-AdmPwd,ms-Mcs-AdmPwdExpirationTime |
Select-Object Name, ms-Mcs-AdmPwd,
@{Name="ExpirationTime";Expression={
  [datetime]::FromFileTime($_.'ms-Mcs-AdmPwdExpirationTime')
}}

This command works only with legacy AdmPwd and must be run by an account delegated to read ms-Mcs-AdmPwd.

For an Identity not found error

Use the computer-object name, such as CLIENT01, not a username.
Confirm the object exists in the correct domain and OU with Get-ADComputer.
Resolve disabled or deleted computer objects first.
Never share the password in chat, screenshots or plain-text files.

Verify module, object and client health

For Identity not found or an empty password, verify the command, computer object and the target client's LAPS diagnostics first.

# Verify the module and computer object
Get-Command Get-LapsADPassword -ErrorAction SilentlyContinue
Get-ADComputer -Identity "CLIENT01" -Properties Enabled,DistinguishedName |
Select-Object Name,Enabled,DistinguishedName

# View LAPS diagnostics on the target client
Get-LapsDiagnostics