MDE - TVM - Security Configuration - Laps (legacy)
MDE TVM Accounts LAPS
Query
// Local Administrator Password Solution - Non-Compliance Details
let DeviceOSInfo = DeviceInfo | where isnotempty(OSVersionInfo)
| summarize arg_max(Timestamp,*)by DeviceId;
DeviceTvmSecureConfigurationAssessment
| where ConfigurationId in ("scid-84")
| summarize arg_max(Timestamp, IsCompliant, IsApplicable) by DeviceId, ConfigurationId, DeviceName
| extend Configuration = case(
ConfigurationId == "scid-84", "Enable LAPS",
"N/A"),
Result = case(IsApplicable == 0, "N/A", IsCompliant == 1, "GOOD", "BAD")
| where IsCompliant == 0
| join kind=leftouter DeviceTvmSecureConfigurationAssessmentKB
on $left.ConfigurationId == $right.ConfigurationId
| project DeviceName, ConfigurationName, ConfigurationCategory, DeviceId
| join kind= leftouter (DeviceOSInfo)
on $left. DeviceId == $right.DeviceIdAbout this query
Explanation
The first query retrieves LAPS (Local Administrator Password Solution) configuration compliance for devices. It summarizes the compliance status (compliant, non-compliant, not applicable) for each configuration and provides additional information such as the total number of devices, percentage of compliant devices, and configuration details.
The second query focuses on non-compliant devices for the LAPS configuration. It retrieves the device name, configuration name, configuration category, and device ID for devices that are not compliant with the LAPS configuration. It also includes information about the device's operating system.
Details
Alex Verboon
Released: September 19, 2023
Tables
DeviceTvmSecureConfigurationAssessmentDeviceTvmSecureConfigurationAssessmentKBDeviceInfo
Keywords
DevicesIntuneUser
Operators
|inwheresummarizearg_maxbyextendcasedcountifjointointprojectletisnotemptykindleftouter