How to Securely Manage Local Administrator Passwords Using Jamf Pro and LAPS (2023)

Jamf added support for LAPS in Jamf Pro 10.46.0 released in April.

TURNS is an abbreviation forLocal administrator password analysis.It was invented by Microsoft in May 2015 as a solution to automatically rotate shared IT administrator account passwords on end-user computers. Since then, it has become an industry standard term used across all platforms.

For decades, desktop admins have been adding shared IT admin accounts to end-user computers when they need to sit in front of a computer or remotely control a computer and log in. However, this approach introduces several serious security issues:

1. Typically, these accounts have the same username and password on different computers. If credentials are leaked to an unauthorized third party, the entire fleet is vulnerable.
2. Many people are familiar with these shared IT administrator credentials and can easily share them with others without any means of controlling access.
3. Because many people know that credentials, end-user privacy, and sensitive data are at risk, but can't see who is using it to access a computer when.
4. If a desktop administrator leaves the organization, someone needs to change the credentials on all computers and share the updated password with other administrators.

LAPS addresses these issues.

While Microsoft may have developed the LAPS workflow, Jamf Pro uses Apple technology to implement it. LAPS Jamf Pro is compatible with all recommended macOS versions listed inJamf Pro system requirements.

Let's take a look at how to use LAPS with Jamf Pro. We'll discuss how to:

• Define an administrator account in the PreStage registration
• View and enable LAPS settings in Jamf Pro
• Apply LAPS settings to your computer
• Check if LAPS is being used on the computer
• Recover local administrator username and password
• LAPS Access Audit
• turn off turn

Automatic device registration must create a local administrator account during registration.

When device auto-enrollment creates a local administrator account, it becomes the only accountManaged Apple administrator account.This means that LAPS in Jamf Pro can only manage local administrator accounts.

The Jamf Pro administrator defines this account name under Computers > PreStage Registration. Each PreStage registration can have its own unique administrator username, but computers are still limited to a single managed Apple administrator account.

To set up PreStage registration using a managed Apple administrator account:

1. Create a new PreStage registration or edit an existing PreStage registration.
2. In Payload Account Settings, enableCreate a local administrator account before installing the wizard.
3. environmentusernameSomething like "localadmin" or any unique name without spaces.
4. placepasswordIverify passwordFields for known passwords. (Later we will try to authenticate with a known password to see if LAPS will break it.)
5. Choose if you want to hide the account and enable MDM on it. These settings do not affect the management of LAPS.
6. Specify the range and save the PreStage recording.
   

Once enabled by the Jamf Pro administrator, machines already registered with existing PreStage are eligible for LAPS management.

In the initial release, LAPS in Jamf Pro can only be configured and viewed through the Jamf Pro API. Jamf will provide LAPS in the Jamf Pro GUI at a later date as the feature set matures. This does not mean that administrators need to learn how to write scripts to use LAPS. They can perform any action in the Jamf Pro API page.

Administrators must ensure their Jamf Pro account is set up before configuring LAPS.set of privilegesis set to "Administrator". If your account's permission set is set to Custom, you should verify that you have enabled two new permissions on the Permissions > Jamf Pro Server Operations tab:

• View local administrator password
• View local administrator password audit history

Let's see how LAPS is configured by default:

1. Open the Jamf Pro server in a web browser and add "/api" to the end of the URL (for example,https://talkingmoose.jamfcloud.com/api).
2. Click the View Jamf Pro API button.
3. At the top of the Jamf Pro API page, enter your Jamf Pro username and password (with LAPS permissions) and click Authorize. The account is authorized for 30 minutes and must then be reauthorized.
   
4. scroll down and clicklocal administrator passwordSix new endpoints were reviewed. (There may be older version 1 endpoints, but they are deprecated and Jamf will remove them later.)
5. clickGET /v2/localadmin_password/settings, click Try it out, and then click Go.
6. In the "Answers" section below, find the text of the answer. It will display the current LAPS Jamf Pro settings.
   

LAPS is disabled by default (Enable automatic deploymentSet to 'false)'. When LAPS is enabled, the password on the computer will be rotated every three months (AutoRotationExpirationTimeAutoRotationExpirationTimeset to "7776000" seconds). And it will automatically rotate the password of the managed Apple administrator account after one hour of showing (Password rotation timeset to "3600" seconds).

Let's enable LAPS:

1. Scroll down and click on the next endpointPUT /v2/localadmin_password/settings.
2. Click Try it out.
3. heLAPS configuration to updateThis field shows the current setting. is editable
4. To enable LAPS, set autoDeployEnabled and autoRotateEnabled to "true". To adjust the frequency of each setting, enter new values ​​in seconds.
5. Click Run.
   
6. The response body shows the updated configuration. Jamf Pro will rotate your computer's managed Apple administrator account password after 15 minutes (900 seconds) of display and automatically change all passwords daily (86400 seconds).
   

The computer must send an inventory report before Jamf Pro can apply your LAPS settings. By default, they upload their inventory once a week.

To force a manifest update on your test machine, open your Terminal application and run the following command:

sudo jamf identify

Alternatively, create a new Jamf Pro policy and enable it.update your inventorywmaintainburden. existGeneralload setoffspringA "loop recording" iexecution frequencyto "Once per computer". Apply the policy to the test computer and save it. Once registered with Jamf Pro, the computer updates its inventory. (It's also a quick way to apply LAPS to a group of computers or an entire fleet.)

How does an administrator know that LAPS is running?

Jamf Pro uses Apple Push Notification service (APN) commands.Set an automatic admin passwordChange your account password. Within seconds of sending the inventory report, the Jamf Pro should send a command to the computer and receive a response.

To verify the command, click Computer > Browse Resources. Click a computer name to view its inventory. Then click History > Manage History. heSet an automatic admin passwordThe command should appear under "Completed Commands".

Another way to check if Jamf Pro has applied LAPS on your computer is to try authenticating with a local administrator account. The easiest way to do this is to log in as the account using Terminal again. runningand(Proxy user) Use the name of the Apple administrator account you manage on your computer:

local administrator

Enter a known password when prompted. If the terminal responds with "Sorry", the known password is no longer valid, which means Jamf Pro has changed the password.

use:The computer itself does not know that it is managed by LAPS. As far as he knows, he was directed to change the password of the Apple administrator account he manages.

Displaying the current LAPS password requires combining several elements.

First, the Jamf Pro administrator needs to restore the computerAdmin ID.This is an identifier created during registration and unique to each computer. It is only stored in Jamf Pro and is only visible through the Jamf Pro API.

1. In the machine inventory log in Jamf Pro, click Inventory > General and noteJamf Pro Computer ID. (This is not the administrator ID, but the computer ID helps identify the next computer.)
2. Return to the Jamf Pro API by adding "/api" to the end of the Jamf Pro server URL and reauthorize if necessary.
3. scroll down and clickcomputer inventoryCheck out your endpoints.
4. clickGET /v1/computers-inventory-detail/{id}, click Try It Out, and enter the standard Jamf Pro PC ID.
5. Click Run.
6. In the "Answers" section below, find the text of the answer. It will display information about your computer.
7. Scroll down the answer a bit and look for managementId. Copy its value.
   

   

8. Scroll down the Jamf Pro API page to return tolocal administrator password.
9. clickGET /v2/local admin password/{clientManagementId}/accounts, click Try it out, and paste the management ID into the clientManagementId field.
10. Click Run.
11. In the "Answers" section below, find the text of the answer. It will display the username of the managed Apple administrator account. (This is the same administrator account username used for PreStage registration.)
    
12. To recover your LAPS account password, scroll up slightly on the Jamf Pro API page.
13. clickGET /v2/local-administrator-password/{clientManagementId}/account/{username}/password, click Try and paste your management ID into the clientManagementId field, then enter the username of your local administrator account in the Username field.
14. Click Run.
15. In the "Answers" section below, find the text of the answer. It will display the password of the managed Apple administrator account.
    

Note that this password is only valid for the time specified in the passwordRotationTime parameter when LAP is enabled. work quickly.

Protecting the privacy of end-user data requires knowing who accessed passwords and when. The LAPS implementation in Jamf Pro provides auditing to disclose this information.

For a successful audit, the Jamf Pro administrators themselves should not use a shared user account when logging into the server. Instead, administrators should set a long, complex password that only one person knows and keep it in a safe place. (Also consider enabling Jamf Propassword policyto allow password recovery for this account, just in case). Each server administrator must then use a uniquely identifiable username with the necessary privileges.

To control who has access to the passwords of LAPS-managed computers:

1. Return to the Jamf Pro API by adding "/api" to the end of the Jamf Pro server URL and reauthorize if necessary.
2. scroll down and clickcomputer inventoryCheck out your endpoints.
3. clickGET /v1/computers-inventory-detail/{id}, click Try It Out, and enter the standard Jamf Pro PC ID.
4. Click Run.
5. In the "Answers" section below, find the text of the answer. It will display information about your computer.
6. Scroll down the answer a bit and look for managementId. Copy its value.
7. To see who has accessed your computer's LAPS password, scroll down and clicklocal administrator passwordCheck out your endpoints.
8. clickGET /v2/local-administrator-password/{clientManagementId}/account/{username}/audit, click Try it out, paste your management ID into the clientManagementId field, and enter your local administrator account's username in the Username field.
9. Click Run.
10. In the "Answers" section below, find the text of the answer. The audit history for the LAPS account will be displayed, including the account name showing the password, the password itself, and the date they were viewed by a Jamf Pro administrator.
    

LAPS Jamf Pro is global. This applies to all computers with a local administrator account created during automatic device enrollment. Therefore, administrators cannot easily apply LAPS settings to only a subset of computers.

Desktop administrators can disable LAPS on existing computers by removing the managed Apple administrator account. Recreating the account with the same name will not re-enable it for LAPS as it will have a different UUID.

To disable LAPS globally, Jamf Pro administrators must follow a specific sequence of operations in order not to lose access to the local administrator account:

1. Return to the Jamf Pro API by adding "/api" to the end of the Jamf Pro server URL and reauthorize if necessary.
2. scroll down and clicklocal administrator passwordCheck out your endpoints.
3. clickPUT /v2/localadmin_password/settingsand click Try it.
4. The LAPS Setting to Update field displays the current setting.
5. Set autoRotateEnabled to false to disable and continue password changes.

Note that LAPS cannot recover the original local administrator account password on a computer, and each computer has a unique password. Although Jamf Pro providesPUT /v2/local-admin-password/{clientManagement}/set-password endpoint, only one computer can be configured at a time. Jamf Pro administrators need to create a Jamf Pro API script to set a password for each computer using LAPS. Administrators should disable LAPS only after ensuring that all passwords have been changed to known passwords:

1. Return to the Jamf Pro API by adding "/api" to the end of the Jamf Pro server URL and reauthorize if necessary.
2. scroll down and clicklocal administrator passwordCheck out your endpoints.
3. clickPUT /v2/localadmin_password/settingsand click Try it.
4. Set autoDeployEnabled to false to disable LAPS.
5. Click Run.

Now is the time for customers to try out LAPS and provide feedback while Jamf is in its early stages. Any customer can sign up for Jamf ProCustomer Feedback ProgramAnd visit the private beta forum. Betas are a great opportunity to see what's next and test key workflows before a new version of Jamf is released. Customers planning to use LAPS in their environment must participate.

Administrators should carefully consider whether LAPS is appropriate for their environment. Ideally, each Jamf Pro admin account should be protected by a combination of a strong password policy, single sign-on using a randomized failover URL, and limited access to other admin account settings. Although products likeinterfering connectionCompatible with LAPS Jamf Pro, both provide secure and controlled administrator access to computers. Implement one of these for simplicity and auditability.

Jamf Cloud customers should test LAPS on their free Jamf Cloud sandbox instances before enabling LAPS on their production servers. Clients can use theiraccount interferenceOr contact your Customer Success Manager.

It's worth reiterating that LAPS is an API-first feature. This means it will only be available in the API until Jamf completes its LAPS feature set. Later, for those who are unhappy with the API, it should be moved to the Jamf Pro GUI.