Skip to main content
Version: 2.2.0

Test-MtMacOSLAPSConfiguration

SYNOPSIS​

Ensure macOS Automated Device Enrollment profiles configure a managed local administrator account with password rotation.

SYNTAX​

Test-MtMacOSLAPSConfiguration [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION​

The Intune implementation of macOS LAPS is not a policy. Unlike Windows LAPS, which is a settings catalog policy, macOS LAPS is configured on the Automated Device Enrollment (ADE) profile itself, on the Account Settings tab. There is no policy object to look for.

When configured, each device enrolling through that ADE profile is provisioned with a local administrator account whose 15-character password is generated, encrypted and stored by Intune, and rotated automatically. Administrators with the right RBAC permission can retrieve or manually rotate it.

Without it, macOS fleets are typically built with a single shared local administrator password baked into an image or a provisioning script. That credential is identical on every Mac, is never rotated, and is the classic lateral-movement primitive: one recovered password grants local administrator access to the entire fleet.

Two properties matter beyond mere presence:

  • A rotation setting must exist. An admin account with no rotation configuration is a static password, which defeats the purpose.
  • Rotate on retrieval should be enabled, so the password is rotated after an administrator views it. Without it, every past viewing remains a valid credential indefinitely.

Note that macOS LAPS only applies to devices that enroll through ADE after a factory reset. Existing devices must be re-enrolled to be covered, so a passing result here describes newly enrolled devices rather than the whole estate.

EXAMPLES​

EXAMPLE 1​

Test-MtMacOSLAPSConfiguration

Returns true if at least one macOS ADE profile provisions a managed local admin account with password rotation.

PARAMETERS​

-ProgressAction​

Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

System.Boolean​

NOTES​

https://maester.dev/docs/commands/Test-MtMacOSLAPSConfiguration