{"id":3605,"date":"2021-06-09T15:31:59","date_gmt":"2021-06-09T14:31:59","guid":{"rendered":"https:\/\/www.lieben.nu\/liebensraum\/?p=3605"},"modified":"2021-06-09T15:31:59","modified_gmt":"2021-06-09T14:31:59","slug":"lightweight-laps-solution-for-intune-mde","status":"publish","type":"post","link":"https:\/\/lieben.nu\/liebensraum\/2021\/06\/lightweight-laps-solution-for-intune-mde\/","title":{"rendered":"Lightweight LAPS solution for INtune (MEM)"},"content":{"rendered":"\n

UPDATE: <\/strong>LeanLAPS has finally been ‘superceded’ by Microsoft’s own LAPS \ud83d\ude42<\/mark> https:\/\/techcommunity.microsoft.com\/t5\/microsoft-entra-azure-ad-blog\/introducing-windows-local-administrator-password-solution-with\/ba-p\/1942487<\/a><\/p>\n\n\n\n

The main differences between Microsoft AAD LAPS and LeanLAPS:<\/p>\n\n\n\n

    \n
  1. MS Won\u2019t enable the account if it\u2019s disabled.<\/li>\n\n\n\n
  2. MS Won\u2019t create the account if it doesn\u2019t exist.<\/li>\n\n\n\n
  3. MS Won\u2019t add it to Administrators group if it\u2019s not a member.<\/li>\n\n\n\n
  4. MS Won\u2019t remove accounts from Administrators group if they\u2019re not supposed to be there.<\/li>\n\n\n\n
  5. MS has an AAD integrated GUI and RBAC<\/li>\n\n\n\n
  6. LeanLAPS requires P2 licensing because it used Proactive Remediations<\/li>\n<\/ol>\n\n\n\n

    LeanLAPS<\/strong><\/p>\n\n\n\n

    Managing local admin accounts using Intune has a lot of quirks, my tele-colleague Rudy Ooms has already written extensively<\/a> about this. He also wrote a PowerShell solution to rotate a specific local admin’s password and had the genius idea of using Proactive Remediations<\/a> (a MEM feature) to display passwords to admins, integrated \/ free in the Intune Console.<\/p>\n\n\n\n

    \"\"<\/a><\/figure>\n\n\n\n

    However, I felt I needed a more lightweight solution that;<\/p>\n\n\n\n