Control: 5.1.4.5 Ensure Local Administrator Password Solution is enabled
Description
Local Administrator Password Solution (LAPS) is the management of local account passwords on Windows devices. LAPS provides a solution to securely manage and retrieve the built-in local admin password. With cloud version of LAPS, customers can enable storing and rotation of local admin passwords for both Microsoft Entra and Microsoft Entra hybrid join devices.
The recommended state is Yes.
Remediation
To remediate using the UI:
- Navigate to
Microsoft Entra admin centerhttps://entra.microsoft.com/. - Click to expand
Entra ID>DevicesselectDevice settings. - Set
Enable Microsoft Entra Local Administrator Password Solution (LAPS)toYes.
Default Value
No.
Usage
Run the control in your terminal:
powerpipe control run microsoft365_compliance.control.cis_v600_5_1_4_5Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run microsoft365_compliance.control.cis_v600_5_1_4_5 --shareSQL
This control uses a named query:
select tenant_id || '/' || id as resource, case when (local_admin_password ->> 'isEnabled')::bool = true then 'ok' else 'alarm' end as status, case when (local_admin_password ->> 'isEnabled')::bool = true then tenant_id || ' has Local Administrator Password Solution (LAPS) enabled.' else tenant_id || ' has Local Administrator Password Solution (LAPS) disabled.' end as reason , tenant_id as tenant_idfrom azuread_device_registration_policy;