Skip to content

Commit aca8ead

Browse files
sdwheelersdwheeler
authored
Merge pull request MicrosoftDocs#3303 from jay98014/user/jsimmons/create_LAPS_powershell_documentation
Create PowerShell documentation for new Windows LAPS feature
2 parents 57d01c5 + c2c4039 commit aca8ead

26 files changed

+4820
-0
lines changed

‎docset/winserver2019-ps/laps/Find-LapsADExtendedRights.md

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
---
2+
description: Queries Active Directory (AD) to find principals that have been granted permission to read Windows Local Administrator Password Solution (LAPS) password attributes.
3+
external help file: lapspsh.dll-Help.xml
4+
Module Name: LAPS
5+
online version: https://learn.microsoft.com/powershell/module/laps/find-lapsadextendedrights?view=windowsserver2019-ps&wt.mc_id=ps-gethelp
6+
schema: 2.0.0
7+
Locale: en-US
8+
ms.date: 04/10/2023
9+
title: Find-LapsADExtendedRights
10+
---
11+
12+
# Find-LapsADExtendedRights
13+
14+
## SYNOPSIS
15+
Queries Active Directory (AD) to find principals that have been granted permission to read Windows
16+
Local Administrator Password Solution (LAPS) password attributes.
17+
18+
## SYNTAX
19+
20+
```
21+
Find-LapsADExtendedRights [-Credential <PSCredential>] -Identity <String[]> [-Domain <String>]
22+
[-DomainController <String>] [-IncludeComputers] [<CommonParameters>]
23+
```
24+
25+
## DESCRIPTION
26+
27+
The `Find-LapsADExtendedRights` cmdlet is used by administrators to query which principals have
28+
been granted permissions to read the LAPS password attributes.
29+
30+
## EXAMPLES
31+
32+
### Example 1
33+
34+
```powershell
35+
Find-LapsADExtendedRights -Identity LapsTestOU
36+
```
37+
38+
```Output
39+
ObjectDN ExtendedRightHolders
40+
-------- --------------------
41+
OU=LapsTestOU,DC=laps,DC=com {NT AUTHORITY\SYSTEM, LAPS\Domain Admins, LAPS\LapsAdmins}
42+
```
43+
44+
This example shows how to run the cmdlet.
45+
46+
## PARAMETERS
47+
48+
### -Credential
49+
50+
Specifies the credentials to use when updating AD. If not specified, the current
51+
user's credentials are used.
52+
53+
```yaml
54+
Type: System.Management.Automation.PSCredential
55+
Parameter Sets: (All)
56+
Aliases:
57+
58+
Required: False
59+
Position: Named
60+
Default value: None
61+
Accept pipeline input: False
62+
Accept wildcard characters: False
63+
```
64+
65+
### -Domain
66+
67+
Specifies the name of the domain to connect to.
68+
69+
```yaml
70+
Type: System.String
71+
Parameter Sets: (All)
72+
Aliases:
73+
74+
Required: False
75+
Position: Named
76+
Default value: None
77+
Accept pipeline input: False
78+
Accept wildcard characters: False
79+
```
80+
81+
### -DomainController
82+
83+
Specifies the name of the domain controller to connect to.
84+
85+
```yaml
86+
Type: System.String
87+
Parameter Sets: (All)
88+
Aliases:
89+
90+
Required: False
91+
Position: Named
92+
Default value: None
93+
Accept pipeline input: False
94+
Accept wildcard characters: False
95+
```
96+
97+
### -Identity
98+
99+
Specifies the name of the OU to query.
100+
101+
This parameter accepts several different name formats that influence the criteria used in the
102+
resultant AD search. The supported name formats are as follows:
103+
104+
- distinguishedName (begins with a `CN=`)
105+
- name (for all other inputs)
106+
107+
```yaml
108+
Type: System.String[]
109+
Parameter Sets: (All)
110+
Aliases:
111+
112+
Required: True
113+
Position: Named
114+
Default value: None
115+
Accept pipeline input: True (ByPropertyName, ByValue)
116+
Accept wildcard characters: False
117+
```
118+
119+
### -IncludeComputers
120+
121+
Specify this parameter to also check computer objects for the permissions.
122+
123+
```yaml
124+
Type: System.Management.Automation.SwitchParameter
125+
Parameter Sets: (All)
126+
Aliases:
127+
128+
Required: False
129+
Position: Named
130+
Default value: None
131+
Accept pipeline input: False
132+
Accept wildcard characters: False
133+
```
134+
135+
### CommonParameters
136+
137+
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
138+
-InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose,
139+
-WarningAction, and -WarningVariable. For more information, see
140+
[about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
141+
142+
## INPUTS
143+
144+
### System.String[]
145+
146+
## OUTPUTS
147+
148+
### System.Object
149+
150+
## NOTES
151+
152+
## RELATED LINKS
153+
154+
[Windows LAPS Overview](https://go.microsoft.com/fwlink/?linkid=2233901)

‎docset/winserver2019-ps/laps/Get-LapsAADPassword.md

Lines changed: 243 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,243 @@
1+
---
2+
description: Queries Azure Active Directory (AAD) for the Windows Local Administrator Password Solution (LAPS) credentials on a specified Azure AD device.
3+
external help file: LAPS-help.xml
4+
Module Name: LAPS
5+
online version: https://learn.microsoft.com/powershell/module/laps/get-lapsaadpassword?view=windowsserver2019-ps&wt.mc_id=ps-gethelp
6+
schema: 2.0.0
7+
Locale: en-US
8+
ms.date: 04/10/2023
9+
title: Get-LapsAADPassword
10+
---
11+
12+
# Get-LapsAADPassword
13+
14+
## SYNOPSIS
15+
Queries Azure Active Directory (AAD) for the Windows Local Administrator Password Solution (LAPS)
16+
credentials on a specified Azure AD device.
17+
18+
## SYNTAX
19+
20+
```
21+
Get-LapsAADPassword -DeviceIds <String[]> [-IncludePasswords] [-IncludeHistory] [-AsPlainText]
22+
[<CommonParameters>]
23+
```
24+
25+
## DESCRIPTION
26+
27+
The `Get-LapsAADPassword` cmdlet allows administrators to retrieve LAPS passwords and password
28+
history for an AAD-joined device. This is implemented by sending queries to Microsoft Graph over the
29+
deviceLocalCredentials collection.
30+
31+
The `Get-LapsAADPassword` cmdlet supports two basic modes when querying LAPS passwords:
32+
33+
The first mode queries for non-sensitive metadata, for example time the password was backed up to
34+
Azure and the expected expiration time of a password. This mode requires that the client be granted
35+
the Microsoft Graph `DeviceLocalCredential.ReadBasic.All` permission.
36+
37+
The second mode queries for all password information including both the metadata information
38+
described above and the clear-text form of the password(s). This mode requires that the client be
39+
granted the Microsoft Graph `DeviceLocalCredential.Read.All` permission.
40+
41+
The **DeviceIds** parameter accepts either device names or device IDs, but the underlying Microsoft
42+
Graph queries only supports querying by device ID. To support this query, the cmdlet maps a device
43+
name input to its corresponding device ID by issuing a separate Microsoft Graph query. This extra
44+
query requires the `Device.Read.All` permission. If the target is a Microsoft Managed Desktop
45+
device, the `DeviceManagementManagedDevices.Read.All` permission may also be required.
46+
47+
> [!TIP]
48+
> If there are multiple devices in the tenant with the same name, the cmdlet fails. The workaround
49+
> is to input the device ID directly.
50+
51+
> [!IMPORTANT]
52+
> The `Get-LapsAADPassword` cmdlet is implemented as a wrapper around the Microsoft Graph PowerShell
53+
> library, which must be manually installed on the device before `Get-LapsAADPassword` can work.
54+
> Additional configuration steps are required in your AAD tenant to enable authentication to
55+
> Microsoft Graph and to grant the necessary Microsoft Graph permissions. For more information, see
56+
> [Get started with Windows LAPS and Azure Active Directory](https://go.microsoft.com/fwlink/?linkid=2233704)
57+
58+
The **Verbose** parameter may be used to get additional information about the cmdlet's operation.
59+
60+
## EXAMPLES
61+
62+
### Example 1
63+
64+
```powershell
65+
Connect-MgGraph -TenantId b20f5886-bddf-43bb-aee6-dda0c87c5fa2 -ClientId 9fa98e34-277f-47fa-9847-e36bdf6bca1f
66+
Get-LapsAADPassword -DeviceIds LAPSAAD
67+
```
68+
69+
```Output
70+
DeviceName DeviceId PasswordExpirationTime
71+
---------- -------- ----------------------
72+
LAPSAAD dfc6d5f0-225a-4b46-adcf-73a349a31e70 4/22/2023 8:45:29 AM
73+
```
74+
75+
This example shows how to query basic LAPS password metadata information for the target device that
76+
is specified by device name.
77+
78+
### Example 2
79+
80+
```powershell
81+
Connect-MgGraph -TenantId b20f5886-bddf-43bb-aee6-dda0c87c5fa2 -ClientId 9fa98e34-277f-47fa-9847-e36bdf6bca1f
82+
Get-LapsAADPassword -DeviceIds dfc6d5f0-225a-4b46-adcf-73a349a31e70 -IncludePasswords
83+
```
84+
85+
```Output
86+
DeviceName : LAPSAAD
87+
DeviceId : dfc6d5f0-225a-4b46-adcf-73a349a31e70
88+
Account : LapsAdmin
89+
Password : System.Security.SecureString
90+
PasswordExpirationTime : 4/22/2023 8:45:29 AM
91+
PasswordUpdateTime : 4/11/2023 8:45:29 AM
92+
```
93+
94+
This example shows how to query the full LAPS password information for the target device that is
95+
specified by device ID.
96+
97+
### Example 3
98+
99+
```powershell
100+
Connect-MgGraph -TenantId b20f5886-bddf-43bb-aee6-dda0c87c5fa2 -ClientId 9fa98e34-277f-47fa-9847-e36bdf6bca1f
101+
Get-LapsAADPassword -DeviceIds dfc6d5f0-225a-4b46-adcf-73a349a31e70 -IncludePasswords -AsPlainText
102+
```
103+
104+
```Output
105+
DeviceName : LAPSAAD
106+
DeviceId : dfc6d5f0-225a-4b46-adcf-73a349a31e70
107+
Account : LapsAdmin
108+
Password : g4q22s[Xz8}!T32[4;Z#0M}v35udF[xB0}iB;P@xk%9E9Tgw,W]7)vx9O!-
109+
PasswordExpirationTime : 4/22/2023 8:45:29 AM
110+
PasswordUpdateTime : 4/11/2023 8:45:29 AM
111+
```
112+
113+
This example shows how to query the full LAPS password information for the target device that is
114+
specified by device ID, and displaying the password in clear-text form.
115+
116+
### Example 4
117+
118+
```powershell
119+
Connect-MgGraph -TenantId b20f5886-bddf-43bb-aee6-dda0c87c5fa2 -ClientId 9fa98e34-277f-47fa-9847-e36bdf6bca1f
120+
Get-LapsAADPassword -DeviceIds lapsAAD -IncludePasswords -AsPlainText -IncludeHistory
121+
```
122+
123+
```Output
124+
DeviceName : LAPSAAD
125+
DeviceId : dfc6d5f0-225a-4b46-adcf-73a349a31e70
126+
Account : LapsAdmin
127+
Password : ]5j)1fi]Rv&Pj+IMiAzq1R9b+yJ.@Q,80#01U541vsC8$Vv${hac8TJlkT8
128+
PasswordExpirationTime : 4/22/2023 8:55:20 AM
129+
PasswordUpdateTime : 4/11/2023 8:55:21 AM
130+
131+
DeviceName : LAPSAAD
132+
DeviceId : dfc6d5f0-225a-4b46-adcf-73a349a31e70
133+
Account : LapsAdmin
134+
Password : t&.1P%9891]24I0X4AA4O22a30R1lz(ar7N9{tTf349.Iz{L82O6v{I+,gg
135+
PasswordExpirationTime :
136+
PasswordUpdateTime : 4/11/2023 8:55:16 AM
137+
138+
DeviceName : LAPSAAD
139+
DeviceId : dfc6d5f0-225a-4b46-adcf-73a349a31e70
140+
Account : LapsAdmin
141+
Password : g4q22s[Xz8}!T32[4;Z#0M}v35udF[xB0}iB;P@xk%9E9Tgw,W]7)vx9O!-
142+
PasswordExpirationTime :
143+
PasswordUpdateTime : 4/11/2023 8:45:29 AM
144+
```
145+
146+
This example shows how to query the full LAPS password information for the target device that is
147+
specified by device name, requesting password history, and displaying the passwords in clear-text
148+
form.
149+
150+
## PARAMETERS
151+
152+
### -AsPlainText
153+
154+
Specify this parameter to return the LAPS passwords in clear-text format. The default behavior is to
155+
return the LAPS passwords wrapped in a .NET **SecureString** object.
156+
157+
> [!IMPORTANT]
158+
> Using this parameter exposes the returned clear-text password to casual viewing and may pose a
159+
> security risk. This parameter should be used with caution and only in support or testing
160+
> situations.
161+
162+
```yaml
163+
Type: System.Management.Automation.SwitchParameter
164+
Parameter Sets: (All)
165+
Aliases:
166+
167+
Required: False
168+
Position: Named
169+
Default value: None
170+
Accept pipeline input: False
171+
Accept wildcard characters: False
172+
```
173+
174+
### -DeviceIds
175+
176+
Specifies the device name or device ID to query LAPS credentials.
177+
178+
```yaml
179+
Type: System.String[]
180+
Parameter Sets: (All)
181+
Aliases:
182+
183+
Required: True
184+
Position: Named
185+
Default value: None
186+
Accept pipeline input: False
187+
Accept wildcard characters: False
188+
```
189+
190+
### -IncludeHistory
191+
192+
Specifies that any older LAPS credentials on the device object should also be displayed.
193+
194+
```yaml
195+
Type: System.Management.Automation.SwitchParameter
196+
Parameter Sets: (All)
197+
Aliases:
198+
199+
Required: False
200+
Position: Named
201+
Default value: None
202+
Accept pipeline input: False
203+
Accept wildcard characters: False
204+
```
205+
206+
### -IncludePasswords
207+
208+
Specifies whether to return password information.
209+
210+
```yaml
211+
Type: System.Management.Automation.SwitchParameter
212+
Parameter Sets: (All)
213+
Aliases:
214+
215+
Required: False
216+
Position: Named
217+
Default value: None
218+
Accept pipeline input: False
219+
Accept wildcard characters: False
220+
```
221+
222+
### CommonParameters
223+
224+
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
225+
-InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose,
226+
-WarningAction, and -WarningVariable. For more information, see
227+
[about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
228+
229+
## INPUTS
230+
231+
### None
232+
233+
## OUTPUTS
234+
235+
### System.Object
236+
237+
## NOTES
238+
239+
## RELATED LINKS
240+
241+
[Windows LAPS Overview](https://go.microsoft.com/fwlink/?linkid=2233901)
242+
243+
[Get started with Windows LAPS and Azure Active Directory](https://go.microsoft.com/fwlink/?linkid=2233704)

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy