How to properly display LAPS information

Question

Dear all,

I am currently trying to display LAPS related information in the ARS Webinterface.

For this purpose I exposed the following 2 attributes:

"msLAPS-Password" and "msLAPS-PasswordExpirationTime"

msLAPS-PasswordExpirationTime displays fine as a date so this is okay.

However msLAPS-Password shows more than it must as it contains the whole string stored in AD which is like "{"n":"<admin_username>","t":"<timestamp>?","p":"<actual_password"}

I need to display only the password, so everything in the quotes after "p:".

How can this be achieved?

Thanks,

Ben

nicole perrine · Accepted Answer

I tackled this with a virtual attribute and a policy script. below is a copy of my script and I have it set in a policy which applies to the computers setup for LAPS. 
 
 function onPostGet($Request){ 
 if($Request.Class -ne "computer") {return} if ($Request.IsAttributeRequested("LAPSPassword") -eq $false) {return} $machineName = $Request.Get("sAMAccountName") 
 try { $customValue = Get-LapsADPassword -Identity $machineName -AsPlainText | ForEach-Object { $_.Password } } catch { # An error occurred $customValue = "An error occurred, verify that this computer is registered with LAPS" } 
 $strAttrname = "LAPSPassword" $Request.Put($strAttrname, $customValue) } #end request class

How to properly display LAPS information

Top Replies