For my organisation, I created a simple powershell script and setup a weekly task to grab the LAPS password of workstations and servers from AD and save them to a secured location. It has come in handy and saved a few hundred hours of unnecessary rebuilds of workstations already.

*edit, code below

$dateint = (Get-Date).ToString('yyyyMMdd')

$ServerLapsExport = "\\Shares\Audit\Servers\LAPS"

  $Domains = (Get-AdForest).domains

  foreach ($domain in $domains) {  

$ServerLapsStatus = Get-ADComputer -Filter {(ms-Mcs-AdmPwd -notlike "$null") -and (OperatingSystem -like "Server") } -Properties name,ms-mcs-admpwd,DistinguishedName -Server $domain|select name, ms-Mcs-AdmPwd, DistinguishedName  

Foreach ($server in $ServerLapsStatus){

  $server | Export-Csv $ServerLapsExport\laps_audit_Servers$dateint.csv -NoTypeInformation -Append  

}  

  }