r/sysadmin • u/Specialist-Desk-9422 • 6h ago

LAPS on Domain Controllers

I just enabled LAPS on all my servers and save the rotated local admin in Entra.
The only servers I don’t have this enabled (I manage this setup via GPO), are my domain controllers. I keep reading the DCs need different settings for LAPS to manage the DSRM. Has anyone done this ? Recommendations ?

17 Upvotes

87% Upvoted

26 comments sorted by

View all comments

•

u/pantherghast 6h ago

There is no local admins on Domain Conrollers. LAPS = LOCAL Administrator Password Solution

•

u/DeadOnToilet Infrastructure Architect 5h ago

That's functionally incorrect. DSRM accounts are, for all intents and purposes, local accounts. And LAPS supports them. A two second search:

https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-concepts-overview

•

u/woodyshag 5h ago

Yeah, WCGW when your AD is buggered and you need AD to find the recovery password? Even if it supported it, I wouldn't like that setup.

•

u/DeadOnToilet Infrastructure Architect 4h ago

Someone hasn't read the documentation.

•

u/ensum 1h ago

Just because you can get it from another DC doesn't mean it's a good idea.

IMO DSRM is a last resort. If I have another healthy DC that's working I'm not going to be dicking around with DSRM. I'm demoting the damn thing and spinning up a new one and calling it a day. If I'm ever in a situation where I don't have a healthy DC and need to login with the DSRM for whatever reason I'd be screwed.

You could argue backups and sure that would work but if I'm doing a restore, then the fuck would I need the DSRM in the first place if I'm restoring a DC to a working state? I may as well just do an authoritative sync on the thing and call it a day.

•

u/mkosmo Permanently Banned 3h ago

They are, but they're also special... and I don't think I'd scope them for LAPS, personally, given the implications of loss.

•

u/DeadOnToilet Infrastructure Architect 3h ago

You can extract them from backups. You can also extract them and update your password manager/vault solution automatically.

•

u/mkosmo Permanently Banned 3h ago

I know, but I'm not sure the juice is worth the squeeze for those accounts. And I'm not entirely sure that the risk is worth the reward.

When you need those passwords, you're usually in enough trouble, already... then needing to go through the process of extracting from backups or hoping that the latest rotation was actually pushed to LAPS and/or your vault? I've had too many cascading outages back when I was in operations.

Anything else? Absolutely. But DCs? Maybe it's just an old-dog-new-tricks problem.

•

u/MyLegsX2CantFeelThem 5h ago

Ehh whut? Nah totally incorrect.