Atliso-LapsRotationAudit

1.0.1

Windows LAPS can report as compliant in Intune while the local admin password
hasn't actually rotated in months. This script confirms whether a successful
password backup was logged inside the expected window, and if not, forces a
rotation with Reset-LapsPassword.

Detection signal: event 10029 (Entra ID backup) or 10018 (Active Directory backup)
in the Microsoft-Windows-LAPS/Operational channel, logged inside
PasswordAgeDays + GraceDays. It also flags event 10005 (policy processing failed),
which means rotation is actively failing rather than just late.

Runs audit-only by default (-WhatIf $true). Set -WhatIf $false to force rotation.

Intune usage: deploy as a Remediation. The detection half exits 1 when no
successful backup is confirmed inside the window. Run as SYSTEM, 64-bit.

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Script -Name Atliso-LapsRotationAudit

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More