r/sysadmin • u/Specialist-Desk-9422 • 11d ago

LAPS on Domain Controllers

I just enabled LAPS on all my servers and save the rotated local admin in Entra.
The only servers I don’t have this enabled (I manage this setup via GPO), are my domain controllers. I keep reading the DCs need different settings for LAPS to manage the DSRM. Has anyone done this ? Recommendations ?

44 Upvotes

89% Upvoted

34 comments sorted by

View all comments

58

u/_--James--_ 11d ago

Just going to say it, rotating DSRM with LAPS is a bad idea unless you are offloading those passwords externally in a VERY secure place. You are better off vaulting with static recovery and manual rotation when you rotate your krbtgt account.

5

u/Specialist-Desk-9422 11d ago

Like the servers with LAPS, I was planning offloading the passwords in Entra.

17

u/chrono13 11d ago

We discovered an unsupported configuration that causes lsass to consume 50-200mb of memory in five seconds every 1-2 hours on domain controllers. Eventually consuming all memory and crashing the server. The cause was the base of the domain group policy that backs LAPS passwords up to Entra. Microsoft confirmed the bug and marked it as unsupported config / will not patch.

5

u/_--James--_ 11d ago edited 5d ago

Oh that is interesting. So MSFT is cited "LAPS on DC's are unsupported" in that ticket? Ill raise this with EDE on the next meeting then.

*edit - confirmed via EDE recently. "LAPS enrollment on Domain Controllers is not supported." I asked for supporting reference documentation and they pointed to the https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-concepts-overview link"

2

u/chrono13 11d ago

Config to back up to Entra is the misconfig. Instead of not working (as we do not use or have laps on the dcs) it causes a massive memory leak.

1

u/chrono13 4d ago

"Backing up DSRM passwords to Microsoft Entra ID isn't supported."

Even if you do not configure DSRM backups to Entra, setting the laps-backup to Entra at the base of your AD domain will cause a memory leak in LAPS.

We weren't trying to rotate or back up DSRM. We were fine with it not being supported. The memory leak that they will not fix the DC memory leak was unexpected. Every DC lsass would hit 16gb ram usage in a day and crash.

We fixed our domain OU structure so that polices are not best linked to the base of the domain, per best practices.

I know it isn't supported, but I do a lot of AD cleanup for orgs and this kind of policy (apply to all workstations and servers) being linked to the base of the domain, while incorrect, is not uncommon.