Microsoft LAPS

CLS

######### https://community.atera.com/discussion/323/microsoft-laps
######### Thanks to Robert Mueller

$AteraAPIKey = '0123456789'
$CustomFieldNameAdminUN = 'LAPS Username'

$CustomFieldNameAdminPW = 'LAPS Password'

$LocalAdminUser = 'LOCALadmin'

$DefaultAdminUser = 'Administrator'
Install nuget
Set-ExecutionPolicy Bypass -Scope Process -Force

Install-PackageProvider NuGet -Force

Import-PackageProvider NuGet -Force
Install and load the right version of Atera module
if (!(Get-Module -ListAvailable -Name PSAtera)) {

Install-Module -Name PSAtera -MinimumVersion 1.3.1 -Force

}

Import-Module -Name PSAtera -MinimumVersion 1.3.1
Set Atera API Key
Set-AteraAPIKey -APIKey $AteraAPIKey

#Function to generate a random password
Function Generate-RandomPassword {

$PasswordLength = 10

$PasswordChars = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz23456789#!-._?,"

$RandomPassword = ''

For ($i = 0; $i -lt $PasswordLength; $i++) {

$RandomPassword += $PasswordChars[(Get-Random -Maximum $PasswordChars.Length)]

}

return $RandomPassword

}

#Get the agent information for the PC that's running the script
$agent = Get-AteraAgent

#Process for Default Administrator Account
$DefaultAdminAccount = [ADSI]"WinNT://./$DefaultAdminUser,user"

$NewPasswordDefaultAdmin = Generate-RandomPassword

$DefaultAdminAccount.PSBase.Invoke("SetPassword", $NewPasswordDefaultAdmin)

$DefaultAdminAccount.PSBase.InvokeSet('AccountDisabled', $true)

$DefaultAdminAccount.PSBase.CommitChanges()

try {

$exists = [ADSI]::Exists("WinNT://./$LocalAdminUser,user")

}

catch {

$exists = $false

}

#Check if local admin_local account exists, if not, create it
$LocalAdminAccount = [ADSI]"WinNT://./$LocalAdminUser,user"

if (-not $exists) {

$NewLocalAdminAccount = [ADSI]"WinNT://.,computer"

$NewUser = $NewLocalAdminAccount.Create("User", $LocalAdminUser)

$PasswordNewUser = Generate-RandomPassword

$NewUser.SetPassword($PasswordNewUser)

$NewUser.SetInfo()

$NewUser.PSBase.InvokeSet('AccountDisabled', $false)

$NewUser.SetInfo()

$NewUser.PSBase.CommitChanges()

# Add user to Administrators group using net localgroup

$addToGroupResult = net localgroup Administrators /add $LocalAdminUser

if ($addToGroupResult -match "The command completed successfully.") {

    Write-Output "Successfully added $LocalAdminUser to Administrators group."

} else {

    Write-Output "Failed to add $LocalAdminUser to Administrators group. Output: $addToGroupResult"

}
}

#Set random password for local admin account
$NewPasswordLocalAdmin = Generate-RandomPassword

$LocalAdminAccount.PSBase.Invoke("SetPassword", $NewPasswordLocalAdmin)

$LocalAdminAccount.PSBase.InvokeSet('AccountDisabled', $false)

$LocalAdminAccount.PSBase.CommitChanges()

#Update the custom field in Atera for local admin_local account
Set-AteraCustomValue -ObjectType Agent -ObjectId $agent.AgentID -FieldName $CustomFieldNameAdminUN -Value $LocalAdminUser

Set-AteraCustomValue -ObjectType Agent -ObjectId $agent.AgentID -FieldName $CustomFieldNameAdminPW -Value $NewPasswordLocalAdmin

#Optionally, add steps here for logging or notification
Write-Output "Administrator and $LocalAdminUser accounts processed."

Thanks @robert.mueller

I took the code and tweaked it a bit via ChatGPT, pasted it back here (pasting it lost some of the powershell syntax such as some "#" but I hope it is ok!)

This script expects that your agents have the custom fields "LAPS Username' and 'LAPS Password'

I had a nightmare getting powershell to recognise that the user existed and could be added to the group so dumbed it down to use "net groups" command instead

Also this Atera code box formatting is whack !

Apologies @robert.mueller I don't often visit these pages so have only recently seen your reply.

The script is working for me here still creating/updating passwords and also updating the Atera console with the new detail.

If you are still having problems we can liaise directly to see if any information I can provide helps to resolve it.