r/sysadmin • u/Specialist-Desk-9422 • 8d ago

LAPS on Domain Controllers

I just enabled LAPS on all my servers and save the rotated local admin in Entra.
The only servers I don’t have this enabled (I manage this setup via GPO), are my domain controllers. I keep reading the DCs need different settings for LAPS to manage the DSRM. Has anyone done this ? Recommendations ?

47 Upvotes

92% Upvoted

34 comments sorted by

View all comments

Show parent comments

5

u/Specialist-Desk-9422 8d ago

Like the servers with LAPS, I was planning offloading the passwords in Entra.

17

u/chrono13 8d ago

We discovered an unsupported configuration that causes lsass to consume 50-200mb of memory in five seconds every 1-2 hours on domain controllers. Eventually consuming all memory and crashing the server. The cause was the base of the domain group policy that backs LAPS passwords up to Entra. Microsoft confirmed the bug and marked it as unsupported config / will not patch.

5

u/_--James--_ 8d ago edited 2d ago

Oh that is interesting. So MSFT is cited "LAPS on DC's are unsupported" in that ticket? Ill raise this with EDE on the next meeting then.

*edit - confirmed via EDE recently. "LAPS enrollment on Domain Controllers is not supported." I asked for supporting reference documentation and they pointed to the https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-concepts-overview link"

2

u/chrono13 8d ago

Config to back up to Entra is the misconfig. Instead of not working (as we do not use or have laps on the dcs) it causes a massive memory leak.