@@ -12,8 +12,8 @@ title: Get-LapsADPassword
12
12
# Get-LapsADPassword
13
13
14
14
## SYNOPSIS
15
- Queries Windows Local Administrator Password Solution (LAPS) credentials from Active Directory on a
16
- specified AD computer or domain controller object.
15
+ Queries Windows Local Administrator Password Solution (LAPS) credentials from Active Directory (AD)
16
+ on a specified AD computer or domain controller object.
17
17
18
18
## SYNTAX
19
19
@@ -34,8 +34,9 @@ Get-LapsADPassword [-Credential <PSCredential>] [-DecryptionCredential <PSCreden
34
34
### DomainControllerMode
35
35
36
36
```
37
- Get-LapsADPassword [-Credential <PSCredential>] [-DecryptionCredential <PSCredential>] [-IncludeHistory]
38
- [-AsPlainText] [-Identity] <String[]> -DomainController <String> [<CommonParameters>]
37
+ Get-LapsADPassword [-Credential <PSCredential>] [-DecryptionCredential <PSCredential>]
38
+ [-IncludeHistory] [-AsPlainText] [-Identity] <String[]> -DomainController <String>
39
+ [<CommonParameters>]
39
40
```
40
41
41
42
### SnapshotBrowserMode
@@ -67,7 +68,7 @@ history for an Active Directory computer or domain controller object. Depending
67
68
configuration, LAPS passwords may be stored in either clear-text form or encrypted form. The
68
69
` Get-LapsADPassword ` cmdlet automatically decrypts encrypted passwords.
69
70
70
- The ` Get-LapsADPassword ` cmdlet may also be used to connected to a mounted Active Directory
71
+ The ` Get-LapsADPassword ` cmdlet may also be used to connected to a mounted AD
71
72
snapshot.
72
73
73
74
The ** Verbose** may be used to get additional information about the cmdlet's operation.
@@ -93,8 +94,8 @@ AuthorizedDecryptor : NotApplicable
93
94
```
94
95
95
96
This example demonstrates querying the current LAPS password for the ` LAPSCLIENT ` computer in the
96
- current domain. The password was stored in Active Directory in clear-text form and didn't require
97
- decryption. The password was returned wrapped in a ** SecureString** object.
97
+ current domain. The password was stored in AD in clear-text form and didn't require decryption. The
98
+ password was returned wrapped in a ** SecureString** object.
98
99
99
100
### Example 2
100
101
@@ -116,8 +117,8 @@ AuthorizedDecryptor : NotApplicable
116
117
117
118
This example demonstrates querying the current LAPS password on a specific domain controller
118
119
(` lapsDC ` ), for the ` LAPSCLIENT ` computer, requesting that the password be displayed in clear-text
119
- form. The password was stored in Active Directory in clear-text form and didn't require decryption.
120
- The password was returned in clear-text form.
120
+ form. The password was stored in AD in clear-text form and didn't require decryption. The password
121
+ was returned in clear-text form.
121
122
122
123
### Example 3
123
124
@@ -147,12 +148,13 @@ DecryptionStatus : Success
147
148
AuthorizedDecryptor : LAPS\LAPS Admins
148
149
```
149
150
150
- This example demonstrates querying the current LAPS password for the ' LAPSCLIENT2' computer, in a
151
- specific Active Directory domain (' laps.com' ), requesting that the password be displayed in
152
- clear-text form. The password was stored in Active Directory in encrypted form and was successfully
151
+ This example demonstrates querying the current LAPS password for the ` LAPSCLIENT2 ` computer, in a
152
+ specific AD domain (` laps.com ` ), requesting that the password be displayed in
153
+ clear-text form. The password was stored in AD in encrypted form and was successfully
153
154
decrypted.
154
155
155
- Note that ExpirationTimestamp will always be empty for any older LAPS passwords returned.
156
+ > [ !NOTE]
157
+ > ** ExpirationTimestamp** is always empty for any older LAPS passwords returned.
156
158
157
159
### Example 4
158
160
@@ -172,9 +174,9 @@ DecryptionStatus : Success
172
174
AuthorizedDecryptor : LAPS\Domain Admins
173
175
```
174
176
175
- This example demonstrates querying the current LAPS password for the ' lapsDC.laps.com' domain
177
+ This example demonstrates querying the current LAPS password for the ` lapsDC.laps.com ` domain
176
178
controller, requesting that the password be displayed in clear-text form. The password was stored in
177
- Active Directory in encrypted form and was successfully decrypted.
179
+ AD in encrypted form and was successfully decrypted.
178
180
179
181
### Example 5
180
182
@@ -194,7 +196,7 @@ DecryptionStatus : Unauthorized
194
196
AuthorizedDecryptor : LAPS\Domain Admins
195
197
```
196
198
197
- This example demonstrates querying the current LAPS password for the ' lapsDC' domain controller when
199
+ This example demonstrates querying the current LAPS password for the ` lapsDC ` domain controller when
198
200
the user doesn't have permissions to decrypt the LAPS DSRM password.
199
201
200
202
### Example 6
@@ -216,8 +218,11 @@ AuthorizedDecryptor : NotApplicable
216
218
```
217
219
218
220
This example demonstrates querying the current LAPS password for the 'lapsLegacyClient' machine
219
- which is currently running in legacy LAPS emulation mode. Note that when querying legacy LAPS-style
220
- passwords, the Account and PasswordUpdateTime fields will always be unavailable.
221
+ which is currently running in legacy LAPS emulation mode.
222
+
223
+ > [ !NOTE]
224
+ > When querying legacy LAPS-style passwords, the ** Account** and ** PasswordUpdateTime** fields are
225
+ > always unavailable.
221
226
222
227
### Example 7
223
228
@@ -237,9 +242,9 @@ DecryptionStatus : NotApplicable
237
242
AuthorizedDecryptor : NotApplicable
238
243
```
239
244
240
- This example demonstrates querying an Active Directory Snapshot browser instance for the current
241
- LAPS password for the ` LAPSCLIENT ` machine. This example assumes that that the snapshot browser has
242
- been previously started on the local machine listening on an LDAP port of ` 50000 ` .
245
+ This example demonstrates querying an AD Snapshot browser instance for the current LAPS password for
246
+ the ` LAPSCLIENT ` machine. This example assumes that that the snapshot browser has been previously
247
+ started on the local machine listening on an LDAP port of ` 50000 ` .
243
248
244
249
## PARAMETERS
245
250
@@ -267,8 +272,8 @@ Accept wildcard characters: False
267
272
268
273
### -Credential
269
274
270
- Specifies a set of credentials to use when querying Active Directory for the LAPS credentials. If
271
- not specified, the current user's credentials are used.
275
+ Specifies a set of credentials to use when querying AD for the LAPS credentials. If not specified,
276
+ the current user's credentials are used.
272
277
273
278
` ` ` yaml
274
279
Type : System.Management.Automation.PSCredential
@@ -301,7 +306,7 @@ Accept wildcard characters: False
301
306
302
307
### -Domain
303
308
304
- Specifies which Active Directory domain to connect to.
309
+ Specifies the name of the domain to connect to.
305
310
306
311
` ` ` yaml
307
312
Type : System.String
@@ -317,8 +322,8 @@ Accept wildcard characters: False
317
322
318
323
### -DomainController
319
324
320
- Specifies which Active Directory domain controller to connect to, or the remote server on which an
321
- Active Directory snapshot browser is running.
325
+ Specifies the name of the domain controller to connect to, or the remote server on which an AD
326
+ Snapshot Browser is running.
322
327
323
328
` ` ` yaml
324
329
Type : System.String
@@ -346,11 +351,10 @@ Accept wildcard characters: False
346
351
347
352
### -Identity
348
353
349
- Specifies which Active Directory computer or domain controller object to retrieve LAPS credentials
350
- from.
354
+ Specifies the name of the computer or domain controller object to retrieve LAPS credentials from.
351
355
352
356
This parameter accepts several different name formats that influence the criteria used when
353
- searching Active Directory for the target device. The supported name formats are as follows:
357
+ searching AD for the target device. The supported name formats are as follows:
354
358
355
359
- distinguishedName (begins with a ` CN=`)
356
360
- samAccountName (begins with a '$")
@@ -387,7 +391,7 @@ Accept wildcard characters: False
387
391
388
392
# ## -Port
389
393
390
- Specifies which Active Directory Snapshot Browser port to connect to.
394
+ Specifies the name of the AD Snapshot Browser port to connect to.
391
395
392
396
` ` ` yaml
393
397
Type: System.Nullable` 1[System.Int32]
@@ -408,7 +412,7 @@ credential via the normal mechanisms. For example, this might be necessary if a
408
412
encrypted against a group that has since been deleted.
409
413
410
414
>[!IMPORTANT]
411
- > When specifying this parameter, you MUST be logged-in locally as a Domain Administrator on a
415
+ > When specifying this parameter, you must be logged-in locally as a Domain Administrator on a
412
416
> writable domain controller.
413
417
414
418
` ` ` yaml
0 commit comments