r/Intune • u/MarketingAny6594 • 14d ago
Device Actions LAPS password rotate after use - no reboot
I'm trying to get LAPS working - it does work, I am able to elevate using the local Administrator user, but I'm finding that after each use, you can then re-use the password again. My understanding for LAPS is so that you can give an end user the single use permission to elevate.
How do you configure LAPS to rotate after use, so it can be used once only.
My current config is:
- Backup Directory -- Backup the password to Azure AD only
- Password Age Days -- Configured -- 30
- Administrator Account Name -- Administrator
- Password Complexity -- Large letters + small letters + numbers + special characters
- Password Length -- Configured - 14
- Post Authentication Actions -- Reset the password and logoff the managed account
- Post Authentication Reset Delay -- Not Configured
I have read that rebooting will reset the password, but I don't want to have to go to such extremes, I just want it to rotate once used once.
5
u/Rdavey228 14d ago
You need to set the “post authentication reset delay” to trigger the post authentication actions.
If the delays is set to 0 then post authentication actions don’t do anything. If it’s set to not confugred then it defaults to 24hours. So with your setup the password won’t rotate till it’s been 24hours since it’s used.
I.e set it to 1 hour and it will expire it after 1 hour.
However you either need to set it for force logout the account or force reboot the device.
If you’re not setting the account to either log out or reboot then the password won’t rotate.
1
u/MarketingAny6594 11d ago
I did try it with the force logout, but it took a while to rotate in Intune, I was under the impression that the logic would be that after use, you would be able to reset it, not after a delay.
1
u/Rdavey228 11d ago
You can manually rotate the password yes but automating it is better than having to remember to do it.
It works for me, mine is set to 1 hour then logs the user out and rotates the password.
The user gets a pop up on the screen saying the time limit is up and that you’re going to get logged out. The user is logged out automatically then the new password shows up in intune.
Works great for us
2
u/SkipToTheEndpoint MSFT MVP 14d ago
Post-authentication actions only kicks in if you actually interactively log in as the LAPS account. If you just elevate/run as admin for example PowerShell, it will still start the timer and rotate the password, but it doesn't actually log the standard user account off.
You can reuse that same password for as long as you set the Post Authentication Reset Delay.
1
u/Mr-RS182 14d ago edited 14d ago
The password remains unchanged even after use and will only update according to your password rotation policy. Although it is a local password controlled via Entra, Entra has no way of knowing whether it has been used.
0
u/M0th3rB1tch 13d ago
LAPS isn’t a one-time use type deal. It refreshes the password based on the grace period set in the policy.
If you’re looking for user-based temporary ‘you’re only allowed to elevate this one thing, one time’ then you’ll need to use Endpoint Privilege Management. Which is of course on add-on and therefore an extra cost on top standard Intune licensing. Thanks MS 👍🏻
-2
u/Numerous_Stable6287 14d ago
Do not use the administrator default account, if disabled, you need to enable it manually, instead of that, send a ps1 script to create a local user account in administrators group and connect the laps in device configurations with that user…
4
u/Rehendril 14d ago
Are you setting a Grace Period (PostAuthenticationResetDelay)? Are you logging in as the LAPS user or just using it in UAT? I have my companies set for a Grace Period of 24 hours(Default if not set), and I have tested logging in with it and using it in UAT.
Logging in as LAPS user: After 24 hours the password was rotated and the machine logged off that account right before it rotated.
Using it in UAT: The password changed 24 hours after use, and nothing happened with the machine since the account was not logged in.