Types of LAPS - Technical Paper: Local Administrator Password Solution for Jamf Pro

Jamf management framework LAPS

Jamf management framework LAPS allows you to manage the Jamf managed local administrator account password via the Jamf management framework, which includes the jamf binary.

A Jamf management framework LAPS account is created during computer enrollment when the Jamf management framework is installed.

Jamf management framework LAPS is enabled by default and is always on.

Some advantages of Jamf management framework LAPS include the following:

Automatic password rotation is always enabled.
Automatic password randomization is enabled.
You can utilize a pre-existing managed local administrator account as a LAPS user, without requiring re-enrollment.
If the managed local administrator account had cryptographic privileges with a secure token, those privileges are maintained during password rotation.
Note:
If the managed local administrator account password for cryptographically enabled accounts becomes out of sync with the password stored in Jamf Pro, password rotation will fail.

For more information, see Device Enrollment for Computers in the Jamf Pro Documentation.

MDM LAPS

MDM LAPS leverages Apple's SetAutoAdminPassword MDM command, which allows management of the managed local administrator account created during the PreStage enrollment process using MDM. The managed local administrator account for MDM LAPS is created on computers enrolled via Automated Device Enrollment during the macOS Setup Assistant.

MDM LAPS is disabled by default. In a future release of Jamf Pro, automatic password randomization for this account will be enabled.

Note:

Jamf does not recommend using MDM LAPS for password rotation if the account needs to use FileVault or authorize software updates on computers with Apple silicon. Rotating a managed local administrator account password from the PreStage enrollment that has become cryptographically enabled with a secure token will result in the login password being changed. However, the new password will not work for cryptographic user authentication purposes.

For more information, see "Provisioning Local Accounts during Automated Device Enrollment" in Automated Device Enrollment for Computers in the Jamf Pro Documentation.

LAPS Settings

Settings for using LAPS are present in both the Jamf Pro interface and the Jamf Pro API. You can manage the following LAPS settings:


Setting	Location
The username for the managed local administrator account. This is specified in the user-initiated enrollment settings and the PreStage enrollment used for Automated Device Enrollment.	Jamf Pro interface
Whether LAPS is enabled (`autoDeployEnabled`) The defaults are: Jamf management framework LAPS: Enabled and always on MDM LAPS: Disabled	Jamf Pro API Jamf Pro interface (Settings > Computer management > Security
The length of time between viewing a managed local administrator account password and rotating the password (`passwordRotationTime`) The default is one hour.	Jamf Pro API Jamf Pro interface (Settings > Computer management > Security
The length of time Jamf Pro routinely rotates the managed local administrator account password (`autoExpirationTime`) The default is 90 days.	Jamf Pro API Jamf Pro interface (Settings > Computer management > Security

Considerations

A computer can have one or both types of LAPS accounts enabled at the same time. Each type of LAPS account supports its own administrator account separate from the other. For example, if a managed local administrator account from a PreStage enrollment was called mdm-admin and a Jamf managed local administrator account was created during enrollment named jmf-admin, both accounts would be available to be managed by a LAPS user. Each account's password will be rotated according to its respective mechanism.

You cannot reallocate a management account created by the Jamf management framework as a management account for MDM LAPS.

The logic used by LAPS-generated passwords meets all the requirements that a native Jamf Pro configuration profile with a Passcode payload is capable of enforcing. Custom configuration profiles may not be met by LAPS logic.