Since LAPSdoes not have a built-in auditing function, third-party applications will have to be used to audit the users who access the local administrator passwords
ManageEngine ADAudit Plus, a real-time AD auditing solution offers a much easier alternative to the same process performed in native AD
Sign in to vote LAPS access auditing:Set-AdmPwdAuditing –OrgUnit: <name of OU on which you want to setup the auditing> -AuditedPrincipals: :<identification of users/groups whose access to password shall be audited>When someone accesses the LAPS password attribute, event ID 4662 is logged on the Domain Controller that responded to the read request
Sign in to vote The worst thing with LAPS auditing is thatstandart security events do not contains information about source IP address of requestor
To solve this issue I just use WebLAPS system which is simple web portal with 2FA and other security features like extended audit log you need
