Integrating EasyLAPS with FileWave

What

EasyLAPS rotates the local administrator password on a Mac and stores the current password in a supported management system. With FileWave, each Mac can keep a unique, regularly rotated password in its device inventory record.

When/Why

Use EasyLAPS when technicians need recoverable local administrator access without reusing one password across the Mac fleet. Unique passwords limit the impact if one Mac's local administrator password is exposed. Choose the escrow mode according to who may view FileWave inventory and who should be able to reveal the password. Document who can access the inventory field and any decryption key.

How

EasyLAPS supports two password escrow modes with FileWave:

Encrypted escrow: The password is encrypted in FileWave and stored in the EasyLAPS Keychain. EasyLAPS uses the locally stored password for the next rotation, then writes the newly generated password to FileWave. The public key is part of the EasyLAPS configuration; the private key is not stored on the Mac and must remain restricted. Use this mode when many technicians can view FileWave inventory but only approved technicians with the EasyLAPS Toolkit and private key should reveal the password.

Clear-text escrow: The password is stored in clear text in FileWave and is not kept locally unless password reversion fails. EasyLAPS reads the current password from FileWave, rotates it, and writes the new password back. Use this mode only when access to the relevant FileWave inventory fields is already limited to the technicians who may reveal the password.

After the first successful rotation, the new password is visible in the device inventory record.

EasyLAPS operates a true rotation of the local administrator password, so the account keeps its cryptographic status. That means that once the password is changed, the account is still a Crypto user and Volume owner, able to unlock the device, install macOS updates, make changes to the startup security policy, initiate an Erase All Content and Settings, and more. 

Agnosys provides the FileWave deployment and configuration documentation with an EasyLAPS purchase. EasyLAPS also supports other management and password-escrow services.

Related Links

• EasyLAPS Official Website - Comprehensive information about EasyLAPS, its features, and support.
  
• Integrating Telepod with FileWave
• Integrating MacOnboardingMate (MOM) with FileWave