Question

Microsoft:

1. In the lab, you set auditing for logon for success and failure, in your own words, why is it important to capture both types of events?

2. What did you learn about Installing and configuring the LAPS tool?

Answer 1

1. It is important to capture both types of events because these events determines whether to audit each instance of a user logging on to or logging off from another device in which this device is used to validate the account. These events on the local computers are generated for the local user account activities, which enables the security of the system.

2. LAPS or Local Administrator Password Solution allows for a piece of software to generate a password for the local administrator and then store that password in plain text in an Active Directory (AD) attribute.

To set up LAPS, perform the following

• Download the LAPS MSI file fro client machine from Windows
• Schema change, here LAPS needs to add two attributes to Active Directory, the administrator password and the expiration time.
• Install the LAPS Group Policy files onto the AD server.
• The LAPS group policy needs to be configured and permissions need to be allocated.
• Install the LAPS DLL onto all the machines in the OU that have the LAPS GPO assigned to it.