Tips-Of-Mine/LAPS
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Hubert Cornet
2023-11-29 17:05:25 +01:00
parent 40a82d6ea2
commit 27dc4dda5e
2 changed files with 146 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

73
LAPS_steps.ps1 Normal file
View File

@@ -0,0 +1,73 @@
Throw "this is not a robust file"
$location = Get-Location
Set-Location C:\Tools\LAPS
$dsnAME = (Get-ADDomain).DistinguishedName
$domain = $env:USERDNSDOMAIN
Throw "Please download LAPS from aka.ms/laps and put the msi files into the C:\Tools\LAPS\LAPS"
#Copy LAPS msi files to sysvol
.\CopyTo-Sysvol.ps1 -FilesPath C:\ADSecurity\LAPS\LAPS -Verbose
#schema extension with LAPS #64 on DC LAB
$lapsPath = "\\$Domain\SysVol\$Domain\Scripts\LAPS\LAPS.x64.msi"
$expression = "C:\Windows\System32\msiexec.exe /i $lapsPath ADDLOCAL=CSE,Management,Management.UI,Management.PS,Management.ADMX /quiet"
Invoke-Expression $expression
<#
#64 on PAW
$lapsPath = "\\$Domain\SysVol\$Domain\Scripts\LAPS.x64.msi"
$expression = "C:\Windows\System32\msiexec.exe /i $LapsPath ADDLOCAL=CSE,Management.PS /quiet"
Invoke-Expression $expression
#32 on PAW
$lapsPath = "\\$Domain\SysVol\$Domain\Scripts\LAPS.x32.msi"
$expression = "C:\Windows\System32\msiexec.exe /i $LapsPath ADDLOCAL=CSE,Management.PS /quiet"
Invoke-Expression $expression
#>
#run as a member of schema admins group
Import-module AdmPwd.PS
Update-AdmPwdADSchema
#Allow computers to store passwords
Import-module AdmPwd.PS
Set-AdmPwdComputerSelfPermission -Identity "OU=Devices,OU=Tier0,OU=Admin,$dsname"
Set-AdmPwdComputerSelfPermission -Identity "OU=Tier0 Servers,OU=Tier0,OU=Admin,$dsname"
Set-AdmPwdComputerSelfPermission -Identity "OU=Devices,OU=Tier1,OU=Admin,$dsname"
Set-AdmPwdComputerSelfPermission -Identity "OU=Tier 1 Servers,$dsname"
Set-AdmPwdComputerSelfPermission -Identity "OU=Workstations,$dsname"
Set-AdmPwdComputerSelfPermission -Identity "OU=Quarantine,$dsname"
#Allow users to read passwords
Import-module AdmPwd.PS
Set-AdmPwdReadPasswordPermission -Identity "OU=Devices,OU=Tier0,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins"
Set-AdmPwdReadPasswordPermission -Identity "OU=Tier0 Servers,OU=Tier0,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins"
Set-AdmPwdReadPasswordPermission -Identity "OU=Devices,OU=Tier1,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins","tier1admins"
Set-AdmPwdReadPasswordPermission -Identity "OU=Tier 1 Servers,$dsname" -AllowedPrincipals "Domain Admins","tier1admins"
Set-AdmPwdReadPasswordPermission -Identity "OU=Workstations,$dsname" -AllowedPrincipals "Domain Admins","tier1admins"
Set-AdmPwdReadPasswordPermission -Identity "OU=Quarantine,$dsname" -AllowedPrincipals "Domain Admins","tier2admins"
#Alow users to reset passwords
Import-module AdmPwd.PS
Set-AdmPwdResetPasswordPermission -Identity "OU=Devices,OU=Tier0,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins"
Set-AdmPwdResetPasswordPermission -Identity "OU=Tier0 Servers,OU=Tier0,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins"
Set-AdmPwdResetPasswordPermission -Identity "OU=Devices,OU=Tier1,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins","tier1admins"
Set-AdmPwdResetPasswordPermission -Identity "OU=Tier 1 Servers,$dsname" -AllowedPrincipals "Domain Admins","tier1admins"
Set-AdmPwdResetPasswordPermission -Identity "OU=Workstations,$dsname" -AllowedPrincipals "Domain Admins","tier1admins"
Set-AdmPwdResetPasswordPermission -Identity "OU=Quarantine,$dsname" -AllowedPrincipals "Domain Admins","tier2admins"
#LAPS Installation GPO
Name: LAPSInstallation-v1.0
Source Starter GPO: (none)
GPO Status: User configuration settings disabled
Category Package Placement Deploy Software Additional Info
Software Installation \\$domain\sysvol\$domain\scripts\LAPS\LAPS.x64.msi Assigned
Category Package Placement Deploy Software Additional Info
Software Installation \\$domain\sysvol\$domainscripts\LAPS\LAPS.x86.msi Assigned Uncheck Make this 32-bit x86 appliction available to Win64 machines
#LAPS Configuration Policy
Name: LAPSConfiguration-v1.0
Source Starter GPO: (none)
GPO Status: User configuration settings disabled
Category Subcategory Policy Setting
Administrative Templates LAPS Password Settings Enabled
Password Complexity: Large letters + small letters + numbers + specials