Skip to content

Instantly share code, notes, and snippets.

@nicolonsky

nicolonsky/LAPS.kql Secret

Last active December 19, 2023 11:55
Show Gist options
  • Save nicolonsky/b567a36af60cf81583a7f01d71b06dd6 to your computer and use it in GitHub Desktop.
Save nicolonsky/b567a36af60cf81583a7f01d71b06dd6 to your computer and use it in GitHub Desktop.
Download ZIP
Get Windows LAPS Password retrieval events
Raw
LAPS.kql
AuditLogs
| where TimeGenerated > ago(360d)
| where OperationName == 'Recover device local administrator password'
| mv-expand TargetResources
| extend DeviceName = TargetResources.displayName
| extend Actor = InitiatedBy.user.userPrincipalName
| extend DeviceId = TargetResources.id
| project TimeGenerated, ActivityDisplayName, Actor, DeviceName, DeviceId
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment