joshua-d-miller/laps-for-macos

A macOS Application for retrieving LAPS AD Passwords

LAPS for macOS

A macOS Application for retrieving LAPS AD Passwords

With this application you can enter your Active Directory credentials that can read LAPS passwords and save them to your keychain. Just enter the computer name and pull the password by clicking Get Password. You can also reset the password which will set an expiration date of January 1, 2001 by clicking Reset Password

Icons made by Freepik http://www.freepik.com from Flaticon https://www.flaticon.com/ is licensed by Creative Commons BY 3.0 - http://creativecommons.org/licenses/by/3.0/"

laps-for-macos's Issues

Enhancement: Allow Return key to Get Password

When typing in a computer name, it would be extremely useful if you could hit the Return key to initiate a search for that record - currently you have to click the Get Password dialog to do this.

App Crashes if Mac Isn't Bound to Domain

The app crashes after entering a computer name and clicking on 'Get Password' if the Mac isn't bound to a domain. Below is crash log.

log.txt

Suggestion: maybe have the app check if the Mac is bound to a domain, and if it isn't, have a message appear saying something along the lines of "Your Mac has to be bound to a domain for this app to work".

When the Mac is off the network and password expires

I have a question on how to prevent the password on the client from expiring and changing unless communication with the AD server is active, if it is needed. We can see ourselves in a position where on a remote client( working from home mac) the VPN connection software is broken. Active VPN needed to communicate to AD server for Laps. The LAPS password on the client has expired and changed and we have no way of finding it out. So we can't authenticate and re install/remove/fix the VPN software for the user. How does your Laps for mac make provision for this type of occurrence. Thanks

Build instructions for noob

Sorry, bit of a noob question here.

I'm a Sys Admin for a K12 school, and we have a mixed fleet of Mac's and Windows machines. We are setting up LAPS and I would like to use this tool, as well as your MacOSLAPS solution on our Mac's, but I'm not a developer so unsure how to build this.

Can you point me in the right direction on how to get started with this?

Appreciate any help you can provide.

"Unable to retrieve Computer Record" for any computer

I know it's terribly vague but I'm receiving "Unable to retrieve Computer Record" for any computer on our domain from my domain-joined admin machine. Is there any logging or debugging I could enable to try and trace the cause?

Blank password

We downloaded this tool and added it to our MDM filewave. We can now search macOS serials and it comes up with nothing in the password field and that the password is set to expire 1/1/0001 12:00:00AM. These are AD joined MacOS devices. We have set these devices to have the ability to reset their password. When setting a new expiration time we get "failed to request password reset."

Macs Not bound to AD

Is there anyway to change this so that it would accept an AD server via config profile kind of like NoMAD so you dont need to be bound to the domain to lookup a windows AD password?

Thanks!

Jamf Recon @ starup policy doesnt get the password

We have a policy to get recon at startup. This doesn't seem to get the password until we actually manually get inventory ourselves or wait for the next automated inventory collection. Do we need to put some kind of delay on the inventory collection at startup?

CLI version?

Hi, great application! I was wondering is there a cli version of this? I'm trying to make Remote Desktop Manager to pull out the LAPS password for a server automatically on macos but to get this working i need to make a script, and this application as a cli version would be very helpful.

Feature Request: Copy Password Button

Rather than highlighting the returned LAPS password from a record and copying via keyboard shortcut or Ctrl+Click, it would be really handy to have a Copy Password button next to the password field.

Auth Fails with non-opendirectory bindings

We use BeyondTrust's AD Bridge (f.k.a. PBIS) to bind our Macs to Active Directory. When attempting to look up LAPS passwords for our Windows inventory, I'm just given a generic message, "Unable to retrieve computer record."

I'm guessing there are some dependencies or assumptions as to how a macOS device normally binds to AD using Apple's built-in tools. I'm willing to help get this working in our environment and push this out on the AppStore (free) so that auto-update mechanisms in the AppStore can be leveraged with MDM solutions.