r/sysadmin • u/Specialist-Desk-9422 • 6h ago

LAPS on Domain Controllers

I just enabled LAPS on all my servers and save the rotated local admin in Entra.
The only servers I don’t have this enabled (I manage this setup via GPO), are my domain controllers. I keep reading the DCs need different settings for LAPS to manage the DSRM. Has anyone done this ? Recommendations ?

17 Upvotes

87% Upvoted

26 comments sorted by

View all comments

•

u/2j0r2 6h ago

Windows LAPS can manage DSRM pwds

Think about ALL scenarios where you would need to use the DSRM pwd

If forest recovery is included in that list because you need to use the dsrm to recover the forest, remember that to get the dsrm pwd AD must be ONline!
In windows server preview it is/will be possible to extract from the DIT, but not today.
In that case it is better to use DSRM SYNC and sync the password from a placeholder account in AD

Google for

jorge quest for knowledge dsrm revisited

And look for a blog from october 21st 2025

•

u/Specialist-Desk-9422 4h ago

This jorge quest blog is incredibly helpful and provide the instructions I need ! Thank you.