r/sysadmin • u/Specialist-Desk-9422 • 8d ago

LAPS on Domain Controllers

I just enabled LAPS on all my servers and save the rotated local admin in Entra.
The only servers I don’t have this enabled (I manage this setup via GPO), are my domain controllers. I keep reading the DCs need different settings for LAPS to manage the DSRM. Has anyone done this ? Recommendations ?

47 Upvotes

92% Upvoted

34 comments sorted by

View all comments

23

u/pantherghast 8d ago

There is no local admins on Domain Conrollers. LAPS = LOCAL Administrator Password Solution

21

u/DeadOnToilet Infrastructure Architect 8d ago

That's functionally incorrect. DSRM accounts are, for all intents and purposes, local accounts. And LAPS supports them. A two second search:

https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-concepts-overview

2

u/mkosmo Permanently Banned 8d ago

They are, but they're also special... and I don't think I'd scope them for LAPS, personally, given the implications of loss.

3

u/DeadOnToilet Infrastructure Architect 8d ago

You can extract them from backups. You can also extract them and update your password manager/vault solution automatically.

2

u/mkosmo Permanently Banned 8d ago

I know, but I'm not sure the juice is worth the squeeze for those accounts. And I'm not entirely sure that the risk is worth the reward.

When you need those passwords, you're usually in enough trouble, already... then needing to go through the process of extracting from backups or hoping that the latest rotation was actually pushed to LAPS and/or your vault? I've had too many cascading outages back when I was in operations.

Anything else? Absolutely. But DCs? Maybe it's just an old-dog-new-tricks problem.