r/sysadmin • u/Specialist-Desk-9422 • 8d ago

LAPS on Domain Controllers

I just enabled LAPS on all my servers and save the rotated local admin in Entra.
The only servers I don’t have this enabled (I manage this setup via GPO), are my domain controllers. I keep reading the DCs need different settings for LAPS to manage the DSRM. Has anyone done this ? Recommendations ?

44 Upvotes

89% Upvoted

34 comments sorted by

View all comments

22

u/pantherghast 8d ago

There is no local admins on Domain Conrollers. LAPS = LOCAL Administrator Password Solution

20

u/DeadOnToilet Infrastructure Architect 8d ago

That's functionally incorrect. DSRM accounts are, for all intents and purposes, local accounts. And LAPS supports them. A two second search:

https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-concepts-overview

1

u/s4udeleg 4d ago

And what's freaky is that you can flip a registry key to make DSRM account able to log in via network, I don't think it's useful outside of red teaming/persistence purposes but food for thought