Windows LAPS PowerShell Commands

Are you familiar with the latest Windows LAPS PowerShell cmdlets? These cmdlets were introduced in the latest version of Windows and allow you to manage Local Administrator Password Solution (LAPS) settings via PowerShell.

LAPS is a tool that allows you to manage the passwords of local administrator accounts on Windows computers. With LAPS, you can set unique, randomly generated passwords for these accounts, which are then securely stored in Active Directory. This helps to improve security and reduce the risk of a security breach due to weak or compromised passwords.

The latest Windows LAPS PowerShell cmdlets make it easy to manage LAPS settings via PowerShell. With these cmdlets, you can automate LAPS tasks and manage LAPS settings across multiple computers, saving time and improving efficiency.

New LAPS PowerShell cmdlets:

• Get-LapsAADPassword - use to query Azure Active Directory for Windows LAPS passwords.
• Get-LapsDiagnostics - use to collect diagnostic information for investigating issues.
• Find-LapsADExtendedRights - use to discover which identities have been granted permissions for an Organization Unit (OU) in Windows Server Active Directory.
• Get-LapsADPassword - use to query Windows Server Active Directory for Windows LAPS passwords.
• Invoke-LapsPolicyProcessing - use to initiate a policy processing cycle.
• Reset-LapsPassword - use to initiate an immediate password rotation.
• Set-LapsADAuditing - use to configure Windows LAPS-related auditing on OUs in Windows Server Active Directory.
• Set-LapsADComputerSelfPermission - use to configure an OU in Windows Server Active Directory to allow computer objects to update their Windows LAPS passwords.
• Set-LapsADPasswordExpirationTime - use to update a computer's Windows LAPS password expiration time in Windows Server Active Directory.
• Set-LapsADReadPasswordPermission - use to grant permission to read the Windows LAPS password information in Windows Server Active Directory.
• Set-LapsADResetPasswordPermission - use to grant permission to update the Windows LAPS password expiration time in Windows Server Active Directory.
• Update-LapsADSchema - use to extend the Windows Server Active Directory schema with the Windows LAPS schema attributes.

Examples

Set-LapsADComputerSelfPermission -Identity 'OU=Servers,OU=Tier1,OU=LakeForest,DC=LakeForestConsulting,DC=com' -Verbose

Download the commands