View Active Directory attribute 'ms-MCs-AdmPwd' (LAPS) without restoring it

I highly doubt that this is possible since this would present security issues around the CV potentially allowing other users (non admins) to view content of a backup. It just doesn`t make sense to me.

In addition to that, from reading the documentation, it doesnt seem like Commvault actually backups up the password, instead the pwd attribute is part of a unicodepwd attribute that is restored with the deleted account from tombstone.

Please refer to 

Restoring User Accounts and Passwords

Hey @Robert - I’ve been rattling my brain to figure out a way to do this, but I don’t think there is an easy way. The only thing I can think of is using block level backups for the domain controller, and then some how mounting the snap to use some AD tools on the ntds database to view attributes.

I can’t recall if there is a manual mount option for the block level snap so you can view the data without restoring … checking on my end.

You are right for regular account passwords (if you choose to NOT modify the scheme so we can protect it), but this is a different attribute. The scheme is extended to store a password that the client uses to pull from AD and set the local admin password. So I suspect the attribute will visible like any other AD object. I do wonder if the password is encrypted though, so even if you got access it may not be usable.

Hi all,

Any news in this topic ?

Has this feature been implemented yet ? If so in which versio/release ?

Thank you,

Frank

@Frankj , I’ll see if I can track down a CMR number, since I’m not able to find any case in @Robert ‘s name.

Adding in, I found a case that referenced this thread which was solved by this:

Please test a backup with the Domain Admin account and let me know the browse results. 

Can you try that and see if the browse works for you as well?

@Mike Struening Thanks for your response. We will solve it by exporting the passwords by script and store them into a password vault. But I keep interested in Commvault solutions to it.

Actualy we don’t have Active directory backup configured with Commvault so I can’t quickly test it, sorry.

Understood.  Glad you at least have a workaround/solution you can utilize!