Detections
Analytics
85.5 (L1) Ensure 'Post-authentication actions' is set to 'Reset the password and logoff the managed account' or higher
Information
This policy settings configures post-authentication actions which will be executed after detecting an authentication by the LAPS managed account. The Action refers to actions to take upon expiry of the grace period before executing the specified post-authentication actions.Post-authentication actions:
- Reset password : upon expiry of the grace period, the managed account password will be reset.
- Reset the password and logoff the managed account : upon expiry of the grace period, the managed account password will be reset and any interactive logon sessions using the managed account will terminated.
- Reset the password and reboot the device : upon expiry of the grace period, the managed account password will be reset and the managed device will be immediately rebooted.
Warning: After an interactive logon session is terminated, other authenticated sessions using the Windows LAPS managed account may still be active. The only way to ensure that the previous password is no longer in use is to reboot the OS.
The recommended state for this setting is: Reset the password and logoff the managed account or higher.
Note: Organizations that utilize third-party commercial software to manage unique & complex local Administrator passwords on domain members may opt to disregard these LAPS recommendations.
Note #2: Windows LAPS does not support standalone computers - they must be joined to an Active Directory domain or Entra ID (formerly Azure Active Directory).
Due to the difficulty in managing local Administrator passwords, many organizations choose to use the same password on all workstations and/or Member Servers when deploying them. This creates a serious attack surface security risk because if an attacker manages to compromise one system and learn the password to its local Administrator account, then they can leverage that account to instantly gain access to all other computers that also use that password for their local Administrator account.
Solution
To establish the recommended configuration from Microsoft Intune Admin Center:- Navigate to Endpoint security > Account protection
- Create or edit a LAPS policy type Local admin password solution (Windows LAPS)
- Set Post Authentication Actions to Reset the password and logoff the managed account (or higher).
Note: Both Reset the password and logoff the managed account and Reset the password and reboot are considered passing states.
Impact:
After the grace period expires, the Windows LAPS managed account password will be reset and logged off the system or the OS will be restarted.
See Also
Item Details
Audit Name: CIS Microsoft Intune for Windows 10 v3.0.1 L1
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(1)
Plugin: Windows
Control ID: b438788d6c74909ad65ee2bc8265ddba8a01cf856c0e91fd572905e7120a68c1