Microsoft LAPS

Question

We are implementing Microsoft LAPS tool. https://technet.microsoft.com/en-us/lib ... 62591.aspx. I would like to setup an after computer object modification action that gives the "ManagedBy" user for a computer account rights to read the computers account Ms-Mcs-AdmPwd attribute then send an email message to the end user.

So what would happen is the helpdesk would assign the end user as the "ManagedBy" of the computer object.
A Business rule would be triggered on Modification of said attribute.
A PowerShell script in the Business rule would then set the rights to the modified computer for the "ManagedBy" user to read "Ms-Mcs-AdmPwd" attribute for that computer only.
An email would go out to the end user with instructions.

Issue:
- The PowerShell module that comes with the LAPS solution is not supported by Adaxes yet even though it only requires PowerShell 2.0 and up.
- I suppose I could use native PowerShell to set the read access to the attribute myself but it would be handy just to use the MS PS Module.

How would you go about setting something like this up?

Thank you

Answer 1

Hello,

The easiest way would be to run your script in a new PowerShell instance. Since it is going to be a separate instance created outside of Adaxes, the limitation to use PowerShell 2.0 only will not apply. For information on how to run a script in a new instance, see the following sample in our Script Repository: http://www.adaxes.com/script-repository ... e-s290.htm.