Using LAPS in the Jamf Pro API

Technical Paper: Local Administrator Password Solution for Jamf Pro
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

The following instructions provide an example workflow for creating both a Jamf management framework LAPS account and an MDM LAPS account in the Jamf Pro interface and using LAPS via the Jamf Pro API. Depending your enrollment workflows, you may have only one LAPS account or none.

  1. In Jamf Pro, do the following:
    1. Navigate to Settings > User-initiated enrollment > Computers and select Create managed local administrator account.
    2. Navigate to Computers > PreStage enrollments > Account Settings and select Create a managed local administrator account before Setup Assistant.
  2. Enroll a computer via Automated Device Enrollment.
  3. Retrieve the Jamf Pro management ID of the computer using the following endpoint: /v1/computers-inventory
  4. Retrieve the LAPS accounts using the following endpoint: -/v2/local-admin-password/{{management_id}}/accounts

    In this scenario, the computer should have two LAPS accounts.

  5. View the LAPS passwords using the following endpoint: -/v2/local-admin-password/{{management_id}}/account/{{username}}/password

    Viewing the LAPS passwords automatically triggers password rotation according to your LAPS settings.

  6. View the audit history of the LAPS passwords using the following endpoint: -/v2/local-admin-password/{{management_id}}/account/{{username}}/audit
    You can now view the password rotations that were triggered earlier. Depending on which LAPS user was queried earlier, the results should now show that the password was viewed.
    Note:

    For successful auditing, Jamf recommends that administrators never use a shared user account when logging in to the Jamf Pro server. Consider also enabling Jamf Pro's Password Policy feature to enable that account for password recovery. Then, each server administrator should use a uniquely identifiable username with necessary privileges.

  7. View the rotation history of the LAPS accounts using the following endpoint: -/v2/local-admin-password/{{management_id}}/account/{{username}}/history

    You should now see the entire LAPS password rotation history for the LAPS users that you have used thus far.

  8. View pending rotations using the following endpoint: -/v2/local-admin-password/pending-rotations

    Depending on the settings enabled at the beginning of this process, some rotations may not have completed yet. This endpoint allows you to see those pending rotations. If no entries are displayed, all LAPS rotation processes have occurred.

  9. (Optional) Set the password manually using the following endpoint: -/v2/local-admin-password/{{management_id}}/set-password
    You can use this endpoint to set a password manually, rather than using a LAPS rotation process, to set the password using LAPS logic.
    Note:

    If you are using a Passcode payload in a configuration profile created natively in Jamf Pro, LAPS-generated passwords should meet and exceed the strictest values. When setting the password manually using this endpoint, passwords may not meet the restrictions requirements and users may be prompted to change the password manually when logging in with LAPS administrator accounts.