Skip to content

Settings reference

Every setting macOSLAPS 4.0 reads, with its built-in default. Deliver them in a configuration profile for the preference domain com.joshua-d-miller.macoslaps (the 3.x domain edu.psu.macoslaps still works through 4.x). Leave a key out to use its default.

Check what a Mac actually uses

sudo macOSLAPS -showConfig prints every setting, its value and where it came from (managed profile, local file or default). FirstPass is never printed.

The same list is in the repository as a Jamf Pro custom schema and an iMazing Profile Editor manifest, and as an example plist.

Account and method

Key Type Default Values What it does
LocalAdminAccount string admin Short name of the local admin account macOSLAPS manages.
Method string AD Local, AD Local stores the password in the System keychain for your MDM to collect with -escrow. AD writes it to the computer object in Active Directory.
DaysTillExpiration integer 60 1 or more Days between rotations.
FirstPass string (none) The account's current password, used once for the first rotation (needed for an account with a secureToken). Never printed by -showConfig.
RemoveKeychain boolean true Delete the admin's login keychain after a rotation, since it would still use the old password.

Password

Key Type Default Values What it does
PasswordStyle string random random, readable, passphrase random, or readable (letters and digits without look-alikes, grouped by 4, for reading over the phone). passphrase falls back to readable for now.
PasswordLength integer 12 1 or more Generated characters. Separators are extra.
PasswordGrouping integer 0 0 or more Insert a separator every N characters (0: none).
PasswordSeparator string - Character between groups.
RemovePassChars string ' Characters never used in a password.
ExclusionSets array of string (empty) any of symbols, letters, numbers Whole sets never used in a password.
PasswordRequirements dictionary Lowercase 0, Uppercase 0, Number 0, Symbol 0 Every password has at least this many of each kind.

Escrow and inventory

Key Type Default Values What it does
EscrowCertificates array of string (empty) RSA certificates (PEM text or base64 DER, one per item). -escrow encrypts its output to them with CMS (AES-256). If set but none is usable, -escrow prints no password.
StagedRotation string auto auto, on, off auto: stage the next password when -escrow ran on this Mac in the last 14 days. on: always. off: rotate immediately.
EscrowConfirmations integer 2 1 or more -escrow exports needed before a staged password is applied.
InventoryHook string (empty) (empty), jamf, custom jamf runs jamf recon after a rotation; custom runs InventoryHookCommand.
InventoryHookCommand array of string (empty) The program and its arguments, one per item.
InventoryHookConfirms boolean false True if the custom command collects inventory, so it confirms a staged password.

Device mode

Key Type Default Values What it does
RetrievalMode string escrow escrow, device escrow: the MDM collects the password (-escrow). device: the MDM collects a reveal code and the password is revealed on the Mac.
RevealGracePeriod integer 4 0–24 Device mode: hours the revealed password keeps working before it rotates (0: no rotation after a reveal).
RevealAction string rotateAndLogout rotateAndLogout, rotate rotateAndLogout logs the admin out first if it has a session; rotate only rotates.
ADRevealCode boolean false Device mode with Method AD: store the reveal code in Active Directory instead of the password.

Admin group protection

Key Type Default Values What it does
ApprovedAdmins array of string (empty) Accounts allowed to stay in the admin group besides the managed admin and root: short names, or group: for a group's members.
AdminGroupPolicy string auto auto, report, enforce auto: remove unapproved admins unless an elevation tool is installed (then report only). report: only list them. enforce: remove them even with an elevation tool.
AllowMDMManagedAccount boolean true If LocalAdminAccount was created by your MDM during Automated Device Enrollment (PreStage admin, Intune ADE admin, Auto Admin), true manages it with a warning (the MDM can change its password too); false refuses.

Active Directory

Key Type Default Values What it does
ADSchema string legacy legacy, windowsLAPS, both legacy: ms-Mcs-AdmPwd. windowsLAPS: msLAPS-Password (ADUC LAPS tab, Get-LapsADPassword). both: write both. windowsLAPS and both are experimental.
PreferredDC string (empty) Domain controller to use with Method AD.