azureblog.co.uk
← cd ~/events
// events/10020-laps · LAPS

Event ID 10020Local account password updated

LAPS updated the managed local account with the new password, after the directory was updated. Shows the account name and RID.

LogMicrosoft-Windows-LAPS/Operational
SourceMicrosoft-Windows-LAPS
AreaLAPS

What to check

None needed.

Find it with PowerShell

Run on the machine that logs it.

powershell2 lines
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-LAPS/Operational'; Id = 10020 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-LAPS/Operational log to your workspace, where it lands in the Event table.

kql5 lines
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-LAPS/Operational" and EventID == 10020
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related LAPS events

Search all 123 event IDs →

Sources