This example creates a new authorization rule, that allows all members of the DOMAIN\AuthorizedLapsReaders group to access the LAPS password for all devices in the AMS group named My devices, and expires the LAPS password after one hour.
This example creates a new authorization rule, that allows all members of the DOMAIN\AuthorizedLapsReaders group to access the LAPS password for all devices in the specified Azure AD tenant, and specifies that the user must provide a reason when requesting access to the LAPS password
This example creates a new authorization rule, that allows all members of the DOMAIN\AuthorizedLapsReaders group to access the LAPS password for all devices in the specified Active Directory OU. It also specifies the audit channels to notify on the event a user triggers this rule.
This example creates a new authorization rule, that allows all members of the DOMAIN\FinaanceAdmins group to JIT into the servers contained within the FinanceServers group. The rule is set to expire on 1st March 2025
PARAMETERS
-AadComputerId
The object ID of an Azure AD computer
Type: String
Parameter Sets: Azure AD computer target authorized by ACL, Azure AD computer target authorized by script
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-AadGroupId
The object ID of an Azure AD group
Type: String
Parameter Sets: Azure AD group target authorized by ACL, Azure AD group target authorized by script
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-AadTenantId
The tenant ID of a registered Azure AD tenant
Type: String
Parameter Sets: Azure AD tenant target authorized by ACL, Azure AD tenant target authorized by script, Azure AD group target authorized by ACL, Azure AD group target authorized by script, Azure AD computer target authorized by ACL, Azure AD computer target authorized by script
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-AdComputer
The fully qualified name or SID of an Active Directory computer
Type: String
Parameter Sets: AD computer target authorized by ACL, AD computer target authorized by script
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-AdContainer
The DN of an Active Directory container object such as an organizational unit
Type: String
Parameter Sets: AD container target authorized by ACL, AD container target authorized by script
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-AdGroup
The fully qualified name or SID of an Active Directory group
Type: String
Parameter Sets: AD group target authorized by ACL, AD group target authorized by script
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
Type: String
Parameter Sets: AMS group target authorized by ACL, AMS group target authorized by script
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-AuthorizationScriptPath
The path to the authorization script to import
Type: String
Parameter Sets: Azure AD tenant target authorized by script, Azure AD group target authorized by script, Azure AD computer target authorized by script, AD computer target authorized by script, AD group target authorized by script, AD container target authorized by script, AMS computer target authorized by script, AMS group target authorized by script
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
Specifies if the user is allowed to extend their JIT access request before it expires
Type: SwitchParameter
Parameter Sets: AD computer target authorized by ACL, AD computer target authorized by script, AD group target authorized by ACL, AD group target authorized by script, AD container target authorized by ACL, AD container target authorized by script
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-JitGroupName
The name of the group that users will be added to when granted access to this role
Type: String
Parameter Sets: AD computer target authorized by ACL, AD computer target authorized by script, AD group target authorized by ACL, AD group target authorized by script, AD container target authorized by ACL, AD container target authorized by script
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-JitMaximumAccessDuration
The maximum amount of time the user can request access to this computer via JIT
Type: TimeSpan
Parameter Sets: AD computer target authorized by ACL, AD computer target authorized by script, AD group target authorized by ACL, AD group target authorized by script, AD container target authorized by ACL, AD container target authorized by script
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-LapsAllowExtension
Specifies if the user is allowed to extend their LAPS access request before it expires
The list of principals who are allowed BitLocker access to this computer.
Type: Object[]
Parameter Sets: AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-PrincipalsAllowedJit
The list of principals who are allowed JIT access to this computer.
Type: Object[]
Parameter Sets: AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-PrincipalsAllowedLaps
The list of principals who are allowed LAPS access to this computer.
Type: Object[]
Parameter Sets: Azure AD tenant target authorized by ACL, Azure AD group target authorized by ACL, Azure AD computer target authorized by ACL, AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL, AMS computer target authorized by ACL, AMS group target authorized by ACL
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-PrincipalsAllowedLapsHistory
The list of principals who are allowed LAPS history access to this computer.
Type: Object[]
Parameter Sets: Azure AD tenant target authorized by ACL, Azure AD group target authorized by ACL, Azure AD computer target authorized by ACL, AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL, AMS computer target authorized by ACL, AMS group target authorized by ACL
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-PrincipalsDeniedBitLocker
The list of principals who are not allowed BitLocker access to this computer.
Type: Object[]
Parameter Sets: AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-PrincipalsDeniedJit
The list of principals who are not allowed JIT access to this computer.
Type: Object[]
Parameter Sets: AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-PrincipalsDeniedLaps
The list of principals who are not allowed LAPS access to this computer.
Type: Object[]
Parameter Sets: Azure AD tenant target authorized by ACL, Azure AD group target authorized by ACL, Azure AD computer target authorized by ACL, AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL, AMS computer target authorized by ACL, AMS group target authorized by ACL
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-PrincipalsDeniedLapsHistory
The list of principals who are not allowed LAPS history access to this computer.
Type: Object[]
Parameter Sets: Azure AD tenant target authorized by ACL, Azure AD group target authorized by ACL, Azure AD computer target authorized by ACL, AD computer target authorized by ACL, AD group target authorized by ACL, AD container target authorized by ACL, AMS computer target authorized by ACL, AMS group target authorized by ACL
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-RuleExpiryDate
A date and time when this rule will expire, expressed in local time
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.