LAPS strange issue

Question

we have enabled AD audit to check the users who read/viewed local administrator password. our issue is that some users are not doing any action but still in the logs is showing that they have accessed and read the password attribute of LAPS.

Answer 1

Hi @Hussain Aziz Hassan Saleh - AC CESS

I don't think there is a LAPS specific command to remove an existing SACL entry, there might be a generic powershell command that might be able to do it, or you can do it manually via the ADUC advanced permissions dialog under the Audit tab.

Gary.

Answer 2

During the installation and configuration LAPS you define the group that is able to read the ms-Mcs-AdmPwd attribute which contains the local admin password as managed by LAPS. Only members of this group and users or groups that have full control of the computer objects are able to read the password.

A couple of things to check:

The AD auditing is set to record the read of the ms-Mcs-AdmPwd attribute
The users in question have rights to read the ms-Mcs-AdmPwd attribute

It's common for AD functions that read the attributes of an object, to ask for all the attributes of the object i.e. attribute=*, if the user has rights to read the ms-Mcs-AdmPwd attribute, then this request will trigger the AD audit read event. So if there is a background task running in the context of the user that reads the AD computer object it could trigger the audit event, i.e. GPO update.

Gary.

Answer 3

Hello @Hussain Aziz Hassan Saleh - AC CESS

This is a normal Audit event triggered by an attribute request rather than the user accessing the data. Basically whenever the system request to see some attributes it may include the ms-mcs-admpwd in AD, which will be done running with User context, thus appearing like the user read/view the administrator password. I can be safely ignored.

Hope this helps with your query,

-------
--If the reply is helpful, please Upvote and Accept as answer--

Answer 4

Thanks a lot..

but what if the audit command was set to audit the Domain Admins group or Everyone such as:

Set-AdmPwdAuditing -Identity:Clients -AuditedPrincipals:Everyone
Set-AdmPwdAuditing -Identity:Clients -AuditedPrincipals:Domain Admins.

and now I want to only audit a specific group ex. LapsAdminGroup. I tried setting the audit only for a specific group like the below:

Set-AdmPwdAuditing -Identity:Clients -AuditedPrincipals:LapsAdminGroup

but the Everyone or Domain Admins group still in effect and cannot be overridden.

Is there a command or a away to remove these groups from auditing, I searched but i wasn't able to find.