ADAudit Plus Laps Report
We are looking to audit our LAPS password attribute reads, but we do not use the GUI tool from Microsoft to read the password attribute. The current LAPS Password Read report only seems to get the events that are generated by the gui tool and not the way we are using PowerShell and adsi searcher to grab the attribute.
Below is the powershell adsi code we are using to grab the attribute
Below is the powershell adsi code we are using to grab the attribute
- $computer = 'testpc'
- $filter = "(&(objectCategory=computer)(objectClass=computer)(cn=$Computer))"
- $pw = ([adsisearcher]$filter).FindOne().Properties['ms-Mcs-AdmPwd']
Below is the 4662 event on a domain controller from the above query
- An operation was performed on an object.
- Subject :
- Security ID: DOMAIN\USERNAME
- Account Name: USERNAME
- Account Domain: DOMAIN
- Logon ID: 0x165FB34B6
- Object:
- Object Server: DS
- Object Type: computer
- Object Name: CN=COMPUTERNAME,OU=Computers,,DC=PLCH,DC=NET
- Handle ID: 0x0
- Operation:
- Operation Type: Object Access
- Accesses: Control Access
- Access Mask: 0x100
- Properties: Control Access
- {bf967a86-0de6-11d0-a285-00aa003049e2}
- {91e647de-d96f-4b70-9557-d63ff4f3ccd8}
- {6617e4ac-a2f1-43ab-b60c-11fbd1facf05}
- {b3f93023-9239-4f7c-b99c-6745d87adbc2}
- {b8dfa744-31dc-4ef1-ac7c-84baf7ef9da7}
- {b7ff5a38-0818-42b0-8110-d3d154c97f24}
- {771727b1-31b8-4cdf-ae62-4fe39fadf89e}
- {aa4e1a6d-550d-4e05-8c35-4afcb917a9fe}
- {612cb747-c0e8-4f92-9221-fdd5f15b550d}
- {4f0d3fc5-ba76-46f5-b8ca-119d985365d6}
- Additional Information:
- Parameter 1: -
- Parameter 2:
Notice it does have the same guid's for the access:
{771727b1-31b8-4cdf-ae62-4fe39fadf89e}
{771727b1-31b8-4cdf-ae62-4fe39fadf89e}
{4f0d3fc5-ba76-46f5-b8ca-119d985365d6}
{bf967a86-0de6-11d0-a285-00aa003049e2}
But it also contains a few others and also has them in a different order.
Any help in getting this to show in the report is greatly appreciated.
Any help in getting this to show in the report is greatly appreciated.