Skip to content

Commit bdcd8ba

Browse files
tiburdtiburd
authored
Merge branch 'main' into patch-148
2 parents c7b1206 + 9cadf98 commit bdcd8ba

26 files changed

+4816
-0
lines changed

‎docset/winserver2019-ps/laps/Find-LapsADExtendedRights.md

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
---
2+
description: Queries Active Directory (AD) to find principals that have been granted permission to read Windows Local Administrator Password Solution (LAPS) password attributes.
3+
external help file: lapspsh.dll-Help.xml
4+
Module Name: LAPS
5+
online version: https://learn.microsoft.com/powershell/module/laps/find-lapsadextendedrights?view=windowsserver2019-ps&wt.mc_id=ps-gethelp
6+
schema: 2.0.0
7+
Locale: en-US
8+
ms.date: 04/10/2023
9+
title: Find-LapsADExtendedRights
10+
---
11+
12+
# Find-LapsADExtendedRights
13+
14+
## SYNOPSIS
15+
Queries Active Directory (AD) to find principals that have been granted permission to read Windows
16+
Local Administrator Password Solution (LAPS) password attributes.
17+
18+
## SYNTAX
19+
20+
```
21+
Find-LapsADExtendedRights [-Credential <PSCredential>] -Identity <String[]> [-Domain <String>]
22+
[-DomainController <String>] [-IncludeComputers] [<CommonParameters>]
23+
```
24+
25+
## DESCRIPTION
26+
27+
The `Find-LapsADExtendedRights` cmdlet is used by administrators to query which principals have
28+
been granted permissions to read the LAPS password attributes.
29+
30+
## EXAMPLES
31+
32+
### Example 1
33+
34+
```powershell
35+
Find-LapsADExtendedRights -Identity LapsTestOU
36+
```
37+
38+
```Output
39+
ObjectDN ExtendedRightHolders
40+
-------- --------------------
41+
OU=LapsTestOU,DC=laps,DC=com {NT AUTHORITY\SYSTEM, LAPS\Domain Admins, LAPS\LapsAdmins}
42+
```
43+
44+
This example shows how to run the cmdlet.
45+
46+
## PARAMETERS
47+
48+
### -Credential
49+
50+
Specifies the credentials to use when updating AD. If not specified, the current
51+
user's credentials are used.
52+
53+
```yaml
54+
Type: System.Management.Automation.PSCredential
55+
Parameter Sets: (All)
56+
Aliases:
57+
58+
Required: False
59+
Position: Named
60+
Default value: None
61+
Accept pipeline input: False
62+
Accept wildcard characters: False
63+
```
64+
65+
### -Domain
66+
67+
Specifies the name of the domain to connect to.
68+
69+
```yaml
70+
Type: System.String
71+
Parameter Sets: (All)
72+
Aliases:
73+
74+
Required: False
75+
Position: Named
76+
Default value: None
77+
Accept pipeline input: False
78+
Accept wildcard characters: False
79+
```
80+
81+
### -DomainController
82+
83+
Specifies the name of the domain controller to connect to.
84+
85+
```yaml
86+
Type: System.String
87+
Parameter Sets: (All)
88+
Aliases:
89+
90+
Required: False
91+
Position: Named
92+
Default value: None
93+
Accept pipeline input: False
94+
Accept wildcard characters: False
95+
```
96+
97+
### -Identity
98+
99+
Specifies the name of the OU to query.
100+
101+
This parameter accepts several different name formats that influence the criteria used in the
102+
resultant AD search. The supported name formats are as follows:
103+
104+
- distinguishedName (begins with a `CN=`)
105+
- name (for all other inputs)
106+
107+
```yaml
108+
Type: System.String[]
109+
Parameter Sets: (All)
110+
Aliases:
111+
112+
Required: True
113+
Position: Named
114+
Default value: None
115+
Accept pipeline input: True (ByPropertyName, ByValue)
116+
Accept wildcard characters: False
117+
```
118+
119+
### -IncludeComputers
120+
121+
Specify this parameter to also check computer objects for the permissions.
122+
123+
```yaml
124+
Type: System.Management.Automation.SwitchParameter
125+
Parameter Sets: (All)
126+
Aliases:
127+
128+
Required: False
129+
Position: Named
130+
Default value: None
131+
Accept pipeline input: False
132+
Accept wildcard characters: False
133+
```
134+
135+
### CommonParameters
136+
137+
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
138+
-InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose,
139+
-WarningAction, and -WarningVariable. For more information, see
140+
[about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
141+
142+
## INPUTS
143+
144+
### System.String[]
145+
146+
## OUTPUTS
147+
148+
### System.Object
149+
150+
## NOTES
151+
152+
## RELATED LINKS
153+
154+
[Windows LAPS Overview](https://go.microsoft.com/fwlink/?linkid=2233901)

‎docset/winserver2019-ps/laps/Get-LapsAADPassword.md

Lines changed: 243 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,243 @@
1+
---
2+
description: Queries Azure Active Directory (AAD) for the Windows Local Administrator Password Solution (LAPS) credentials on a specified Azure AD device.
3+
external help file: LAPS-help.xml
4+
Module Name: LAPS
5+
online version: https://learn.microsoft.com/powershell/module/laps/get-lapsaadpassword?view=windowsserver2019-ps&wt.mc_id=ps-gethelp
6+
schema: 2.0.0
7+
Locale: en-US
8+
ms.date: 04/10/2023
9+
title: Get-LapsAADPassword
10+
---
11+
12+
# Get-LapsAADPassword
13+
14+
## SYNOPSIS
15+
Queries Azure Active Directory (AAD) for the Windows Local Administrator Password Solution (LAPS)
16+
credentials on a specified Azure AD device.
17+
18+
## SYNTAX
19+
20+
```
21+
Get-LapsAADPassword -DeviceIds <String[]> [-IncludePasswords] [-IncludeHistory] [-AsPlainText]
22+
[<CommonParameters>]
23+
```
24+
25+
## DESCRIPTION
26+
27+
The `Get-LapsAADPassword` cmdlet allows administrators to retrieve LAPS passwords and password
28+
history for an AAD-joined device. This is implemented by sending queries to Microsoft Graph over the
29+
deviceLocalCredentials collection.
30+
31+
The `Get-LapsAADPassword` cmdlet supports two basic modes when querying LAPS passwords:
32+
33+
The first mode queries for non-sensitive metadata, for example time the password was backed up to
34+
Azure and the expected expiration time of a password. This mode requires that the client be granted
35+
the Microsoft Graph `DeviceLocalCredential.ReadBasic.All` permission.
36+
37+
The second mode queries for all password information including both the metadata information
38+
described above and the clear-text form of the password(s). This mode requires that the client be
39+
granted the Microsoft Graph `DeviceLocalCredential.Read.All` permission.
40+
41+
The **DeviceIds** parameter accepts either device names or device IDs, but the underlying Microsoft
42+
Graph queries only supports querying by device ID. To support this query, the cmdlet maps a device
43+
name input to its corresponding device ID by issuing a separate Microsoft Graph query. This extra
44+
query requires the `Device.Read.All` permission. If the target is a Microsoft Managed Desktop
45+
device, the `DeviceManagementManagedDevices.Read.All` permission may also be required.
46+
47+
> [!TIP]
48+
> If there are multiple devices in the tenant with the same name, the cmdlet fails. The workaround
49+
> is to input the device ID directly.
50+
51+
> [!IMPORTANT]
52+
> The `Get-LapsAADPassword` cmdlet is implemented as a wrapper around the Microsoft Graph PowerShell
53+
> library, which must be manually installed on the device before `Get-LapsAADPassword` can work.
54+
> Additional configuration steps are required in your AAD tenant to enable authentication to
55+
> Microsoft Graph and to grant the necessary Microsoft Graph permissions. For more information, see
56+
> [Get started with Windows LAPS and Azure Active Directory](https://go.microsoft.com/fwlink/?linkid=2233704)
57+
58+
The **Verbose** parameter may be used to get additional information about the cmdlet's operation.
59+
60+
## EXAMPLES
61+
62+
### Example 1
63+
64+
```powershell
65+
Connect-MgGraph -TenantId b20f5886-bddf-43bb-aee6-dda0c87c5fa2 -ClientId 9fa98e34-277f-47fa-9847-e36bdf6bca1f
66+
Get-LapsAADPassword -DeviceIds LAPSAAD
67+
```
68+
69+
```Output
70+
DeviceName DeviceId PasswordExpirationTime
71+
---------- -------- ----------------------
72+
LAPSAAD dfc6d5f0-225a-4b46-adcf-73a349a31e70 4/22/2023 8:45:29 AM
73+
```
74+
75+
This example shows how to query basic LAPS password metadata information for the target device that
76+
is specified by device name.
77+
78+
### Example 2
79+
80+
```powershell
81+
Connect-MgGraph -TenantId b20f5886-bddf-43bb-aee6-dda0c87c5fa2 -ClientId 9fa98e34-277f-47fa-9847-e36bdf6bca1f
82+
Get-LapsAADPassword -DeviceIds dfc6d5f0-225a-4b46-adcf-73a349a31e70 -IncludePasswords
83+
```
84+
85+
```Output
86+
DeviceName : LAPSAAD
87+
DeviceId : dfc6d5f0-225a-4b46-adcf-73a349a31e70
88+
Account : LapsAdmin
89+
Password : System.Security.SecureString
90+
PasswordExpirationTime : 4/22/2023 8:45:29 AM
91+
PasswordUpdateTime : 4/11/2023 8:45:29 AM
92+
```
93+
94+
This example shows how to query the full LAPS password information for the target device that is
95+
specified by device ID.
96+
97+
### Example 3
98+
99+
```powershell
100+
Connect-MgGraph -TenantId b20f5886-bddf-43bb-aee6-dda0c87c5fa2 -ClientId 9fa98e34-277f-47fa-9847-e36bdf6bca1f
101+
Get-LapsAADPassword -DeviceIds dfc6d5f0-225a-4b46-adcf-73a349a31e70 -IncludePasswords -AsPlainText
102+
```
103+
104+
```Output
105+
DeviceName : LAPSAAD
106+
DeviceId : dfc6d5f0-225a-4b46-adcf-73a349a31e70
107+
Account : LapsAdmin
108+
Password : g4q22s[Xz8}!T32[4;Z#0M}v35udF[xB0}iB;P@xk%9E9Tgw,W]7)vx9O!-
109+
PasswordExpirationTime : 4/22/2023 8:45:29 AM
110+
PasswordUpdateTime : 4/11/2023 8:45:29 AM
111+
```
112+
113+
This example shows how to query the full LAPS password information for the target device that is
114+
specified by device ID, and displaying the password in clear-text form.
115+
116+
### Example 4
117+
118+
```powershell
119+
Connect-MgGraph -TenantId b20f5886-bddf-43bb-aee6-dda0c87c5fa2 -ClientId 9fa98e34-277f-47fa-9847-e36bdf6bca1f
120+
Get-LapsAADPassword -DeviceIds lapsAAD -IncludePasswords -AsPlainText -IncludeHistory
121+
```
122+
123+
```Output
124+
DeviceName : LAPSAAD
125+
DeviceId : dfc6d5f0-225a-4b46-adcf-73a349a31e70
126+
Account : LapsAdmin
127+
Password : ]5j)1fi]Rv&Pj+IMiAzq1R9b+yJ.@Q,80#01U541vsC8$Vv${hac8TJlkT8
128+
PasswordExpirationTime : 4/22/2023 8:55:20 AM
129+
PasswordUpdateTime : 4/11/2023 8:55:21 AM
130+
131+
DeviceName : LAPSAAD
132+
DeviceId : dfc6d5f0-225a-4b46-adcf-73a349a31e70
133+
Account : LapsAdmin
134+
Password : t&.1P%9891]24I0X4AA4O22a30R1lz(ar7N9{tTf349.Iz{L82O6v{I+,gg
135+
PasswordExpirationTime :
136+
PasswordUpdateTime : 4/11/2023 8:55:16 AM
137+
138+
DeviceName : LAPSAAD
139+
DeviceId : dfc6d5f0-225a-4b46-adcf-73a349a31e70
140+
Account : LapsAdmin
141+
Password : g4q22s[Xz8}!T32[4;Z#0M}v35udF[xB0}iB;P@xk%9E9Tgw,W]7)vx9O!-
142+
PasswordExpirationTime :
143+
PasswordUpdateTime : 4/11/2023 8:45:29 AM
144+
```
145+
146+
This example shows how to query the full LAPS password information for the target device that is
147+
specified by device name, requesting password history, and displaying the passwords in clear-text
148+
form.
149+
150+
## PARAMETERS
151+
152+
### -AsPlainText
153+
154+
Specify this parameter to return the LAPS passwords in clear-text format. The default behavior is to
155+
return the LAPS passwords wrapped in a .NET **SecureString** object.
156+
157+
> [!IMPORTANT]
158+
> Using this parameter exposes the returned clear-text password to casual viewing and may pose a
159+
> security risk. This parameter should be used with caution and only in support or testing
160+
> situations.
161+
162+
```yaml
163+
Type: System.Management.Automation.SwitchParameter
164+
Parameter Sets: (All)
165+
Aliases:
166+
167+
Required: False
168+
Position: Named
169+
Default value: None
170+
Accept pipeline input: False
171+
Accept wildcard characters: False
172+
```
173+
174+
### -DeviceIds
175+
176+
Specifies the device name or device ID to query LAPS credentials.
177+
178+
```yaml
179+
Type: System.String[]
180+
Parameter Sets: (All)
181+
Aliases:
182+
183+
Required: True
184+
Position: Named
185+
Default value: None
186+
Accept pipeline input: False
187+
Accept wildcard characters: False
188+
```
189+
190+
### -IncludeHistory
191+
192+
Specifies that any older LAPS credentials on the device object should also be displayed.
193+
194+
```yaml
195+
Type: System.Management.Automation.SwitchParameter
196+
Parameter Sets: (All)
197+
Aliases:
198+
199+
Required: False
200+
Position: Named
201+
Default value: None
202+
Accept pipeline input: False
203+
Accept wildcard characters: False
204+
```
205+
206+
### -IncludePasswords
207+
208+
Specifies whether to return password information.
209+
210+
```yaml
211+
Type: System.Management.Automation.SwitchParameter
212+
Parameter Sets: (All)
213+
Aliases:
214+
215+
Required: False
216+
Position: Named
217+
Default value: None
218+
Accept pipeline input: False
219+
Accept wildcard characters: False
220+
```
221+
222+
### CommonParameters
223+
224+
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
225+
-InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose,
226+
-WarningAction, and -WarningVariable. For more information, see
227+
[about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
228+
229+
## INPUTS
230+
231+
### None
232+
233+
## OUTPUTS
234+
235+
### System.Object
236+
237+
## NOTES
238+
239+
## RELATED LINKS
240+
241+
[Windows LAPS Overview](https://go.microsoft.com/fwlink/?linkid=2233901)
242+
243+
[Get started with Windows LAPS and Azure Active Directory](https://go.microsoft.com/fwlink/?linkid=2233704)

0 commit comments

Comments
 (0)