View Code? Open in Web Editor
NEW
This project forked from truekillrob/slaps
A simple Powershell-based serverless LAPS implementation with Azure KeyVault and LogAnalytics
License: Other
poormanscloudlaps's Introduction
a simple solution for Servers
It all started from leanLAPS from LiebenConsulting: leanLAPS
- Does not require/modifying registry keys
- Does not store passwords locally
- Can automatically rename the local Administrator account
- Can remove/cleanup any other local admin accounts
- Administrators group Cleanup can be filtered by SID
- Stores passwords in Azure Key Vault using Computer Name
- Authentication using Azure App
- Maximum possible security - App only requires 'Set Secret' permission on key vault (Cannot read secrets)
- Logs activites to a Log Analytics Workspace
- Does not need external PowerShell modules
- Does not use/need Intune
- Uses Windows Password expiration policy to establish password reset cadence
- Source code from here
- A method for deploy files and scheduled tasks to intended computers
- Microsoft Azure Key Vault
- Microsoft Azure Log Analytics
Creation of Azure KeyVault and Log Analytics Workspace
- Logon to Azure
- Create Resource Group or use an existing
- Create a KeyVault in a region of your choice
- Set Permissions in your KeyVault using RBAC
- Create a Log Analytics workspace [https://learn.microsoft.com/en-us/azure/azure-monitor/logs/quick-create-workspace?tabs=azure-portal]
Creating a parameters file
- Run createConfig.ps1 to create a sample configuration file
- Modify parameters as needed
- Rename config template file to CloudLAPS.xml, this file should be in the same folder where the script resides/is run from.
Installation of CloudLAPS.ps1
- On a test computer, create a folder like C:\Temp\CloudLAPS
- Clone this repo or download the CloudLAPS.ps1 file
- Copy the xml file using CloudLAPS.xml file name into the same folder.
- Open a powershell prompt, change to the folder and run the script.
- Check the local Application log file for a succesful result
- Check the Log Analytics workspace for activity **
- Check the Key Vault for the updated secret
- If all works, create a Scheduled Task that runs this script as SYSTEM with the desired frequency.
- Switch to Managed Identity authentication (Azure VM and Arc Onboarded Servers).
poormanscloudlaps's People
Watchers