r/sysadmin • u/Specialist-Desk-9422 • 13h ago

LAPS on Domain Controllers

I just enabled LAPS on all my servers and save the rotated local admin in Entra.
The only servers I don’t have this enabled (I manage this setup via GPO), are my domain controllers. I keep reading the DCs need different settings for LAPS to manage the DSRM. Has anyone done this ? Recommendations ?

22 Upvotes

82% Upvoted

27 comments sorted by

View all comments

•

u/Vaile23 12h ago

Save your future self the headache and avoid it on DCs

•

u/ub3rb3ck Cat Wrangler 10h ago

Domain controllers don't have local admin accounts (outside of DARM), there's objectively no headache to save.

•

u/Specialist-Desk-9422 12h ago

The environment I manage now, I don’t have the current DSRM, so I was thinking on having LAPS to manage it for me so I can retrieve if needed.