Which version of Privilege Secure do you have?
Privilege Secure AM 26.07.00001
What is a one sentence summary of your feature request?
NPS Should support modern LAPS within it’s integration connectors.
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
As of right now it seems NPS only supports legacy LAPS via it’s built in integration connector. I have pulled up the underlying PowerShell scripts that the server appears to be calling from and can confirm it is pulling just the ms-MCS-AdmPwd and ms-MCS-AdmPwdExpirationTime properties from the targeted computer.
Unfortunately, we have migrated to modern LAPS which stores the credentials encrypted and require a slightly different set of commands to pull the data. Netwrix could leverage the Get-LapsADPassword cmdlet to achieve this result fairly simply. Ideally I’d love for Netwrix to build out either a separate integration connector that supports choosing a service account that can decrypt the modern LAPS credential OR giving up the option to select a service account to use with a BYOV integration connector.
The second option would allow more flexibility with all BYOV connectors since you could pass credentials into the custom actions and avoid hard coding the credentials. I would have simply created a custom BYOV connector to support this if it wouldn’t have required hard coding the credential into the script.
How do you currently solve the challenges you have by not having this feature?
As of right now there is not a secure way to achieve this. You could insecurely create a custom BYOV connector to achieve this, but we are not okay with that risk. As such, we have to grant access to LAPS credentials outside of the product.