Is an attribute "On-View" Trigger Condition Possible

Question

Is it possible to trigger a command based on a user viewing an attribute (native AD or custom)?

Scenario is a Web UI user viewing a sensitive object attribute (in our case the value of the local administrator password for a computer - either a custom Adaxes attribute or the native 'LAPS' attribute used to store randomised passwords when using MS LAPS).

In this scenario we'd like this to trigger an action to force a reset of the password (by updating the/an accompanying change date attribute).

Thanks

Answer 1

Hello,

For this specific scenario we suggest using a Custom Command. You can create a Custom Command executed on a computer object that outputs the current password of the computer to the Execution Log and also schedules a password reset. To do this, the Custom Command needs to launch a PowerShell script. For information on how to update the Execution Log using a script, see section Updating the Execution Log in Server-Side Scripting. To schedule a password reset, you need to use the Reset-AdmPwdPassword from the LAPS management tools.

For information on how to create a Custom Command, see the Create a Custom Command Tutorial. Use it as a guide.

• On step 3 of the tutorial, select Computer.
  
• On step 4, add the Run a program or PowerShell script action.