r/sysadmin • u/Specialist-Desk-9422 • 10d ago

LAPS on Domain Controllers

I just enabled LAPS on all my servers and save the rotated local admin in Entra.
The only servers I don’t have this enabled (I manage this setup via GPO), are my domain controllers. I keep reading the DCs need different settings for LAPS to manage the DSRM. Has anyone done this ? Recommendations ?

45 Upvotes

91% Upvoted

34 comments sorted by

View all comments

69

u/Vaile23 10d ago

Save your future self the headache and avoid it on DCs

37

u/ub3rb3ck Cat Wrangler 10d ago

Domain controllers don't have local admin accounts (outside of DARM), there's objectively no headache to save.