#Microsoft intune reset windows 10 device password password

configure if other local admins should be removed, what the local admin name should be and the password length). Download and doublecheck the config of LeanLAPS.ps1 (e.g. head into the Proactive Remediations section of MDE and click Create script package:ģ. ‘Administrators’ vs ‘Administradores’….)ġ. can whitelist approved admins or groups from AzureAD or Active Directory.can remove any other local admin accounts if desired.automatically provisions a local admin account.does not need separate detection and remediation scripts.However, I felt I needed a more lightweight solution that He also wrote a PowerShell solution to rotate a specific local admin’s password and had the genius idea of using Proactive Remediations (a MEM feature) to display passwords to admins, integrated / free in the Intune Console. Managing local admin accounts using Intune has a lot of quirks, my tele-colleague Rudy Ooms has already written extensively about this. LeanLAPS requires P2 licensing because it used Proactive Remediations.MS Won’t remove accounts from Administrators group if they’re not supposed to be there.

MS Won’t add it to Administrators group if it’s not a member.MS Won’t create the account if it doesn’t exist.MS Won’t enable the account if it’s disabled.The main differences between Microsoft AAD LAPS and LeanLAPS: UPDATE: LeanLAPS has finally been ‘superceded’ by Microsoft’s own LAPS 🙂