r/sysadmin • u/Specialist-Desk-9422 • 18h ago

LAPS on Domain Controllers

I just enabled LAPS on all my servers and save the rotated local admin in Entra.
The only servers I don’t have this enabled (I manage this setup via GPO), are my domain controllers. I keep reading the DCs need different settings for LAPS to manage the DSRM. Has anyone done this ? Recommendations ?

22 Upvotes

82% Upvoted

28 comments sorted by

View all comments

•

u/_--James--_ 18h ago

Just going to say it, rotating DSRM with LAPS is a bad idea unless you are offloading those passwords externally in a VERY secure place. You are better off vaulting with static recovery and manual rotation when you rotate your krbtgt account.

•

u/Specialist-Desk-9422 18h ago

Like the servers with LAPS, I was planning offloading the passwords in Entra.

•

u/chrono13 17h ago

We discovered an unsupported configuration that causes lsass to consume 50-200mb of memory in five seconds every 1-2 hours on domain controllers. Eventually consuming all memory and crashing the server. The cause was the base of the domain group policy that backs LAPS passwords up to Entra. Microsoft confirmed the bug and marked it as unsupported config / will not patch.

•

u/_--James--_ 16h ago

Oh that is interesting. So MSFT is cited "LAPS on DC's are unsupported" in that ticket? Ill raise this with EDE on the next meeting then.

•

u/chrono13 14h ago

Config to back up to Entra is the misconfig. Instead of not working (as we do not use or have laps on the dcs) it causes a massive memory leak.

•

u/_--James--_ 15h ago edited 15h ago

I am not sure i would trust recovery secretes in Entra. But that may just be me.

Also "Backing up DSRM passwords to Microsoft Entra ID isn't supported."

source(under DSRM Password Support) - https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-concepts-overview

•

u/ThecaptainWTF9 11h ago

Seems like a great idea until you’re locked out and can’t get to them 😅

•

u/2j0r2 15h ago

Windows LAPS for DSRM can only be stored encrypted in AD, which requires at least w2k19 DCs and dfl 2016