msLAPS-EncryptedPassword attribute not being decrypted in view

Question

We are implementing the new version of LAPS built into Windows 10 with KB5025221. I've added the attribute to the Management Views for Computers, but the password is not being decrypted. I've added the Adaxes Service Account to permissions for LAPS password decryption as well.

The old LAPS Attribute (ms-Mcs-AdmPwd) is not available, as we have not loaded it into AD and plan to use the latest implementation of LAPS.

Comments

I've been playing around with a powershell way of doing it. Please use at your own risk

A few things:

1. -AsPlainText option is for Encrypted Passwords.
2. This displays it to the user and also logs it. So you'll see the password in the logs. Unless you want to turn off logging for Powershell scripts.

Import-Module Adaxes

# Get computer domain name
$domainName = $Context.GetObjectDomain("%distinguishedName%")

$searchresults = Get-LapsADPassword -identity "%cn%" -AsPlainText  



$name = $SearchResults.ComputerName 
$password = $SearchResults.Password
$passupdate = $SearchResults.PasswordUpdateTime

$Context.LogMessage("ComputerName: " + $name, "Information")
$Context.LogMessage("Password: " + $password, "Information")
$Context.LogMessage("Last Password update: " + $passupdate, "Information")

As another option I was thinking of just writing to a file on a server and cleaning up the directory daily until I can find a better option to not to display this and not Log the password.

Answer 1

Hello,

Thank you for the provided details. Unfortunately, there is no possibility to achieve the desired with the update. We keep monitoring the possibilities provided by LAPS. Should there be any updates, we will investigate existing approaches that could be used in Adaxes.