Windows LAPS

How to Manage Local Admin Passwords and DSRM Passwords with Windows LAPS

[kyleduncan]

Very helpful! Thanks for explaining this clearly. This is way easier than setting up Legacy LAPS.

[ninjaowl]

This was awesome, thank you for posting this! Helped me out.

[fbifido]

the local Admin username is still "Administrator"?
can LAPS rename/randomized this account as well?

[JoshuaWilson-tk]

I ran through these steps exactly, but LAPS doesn't appear for me under Group Policy Management Editor. Any idea why this might be?

[NevaranUniverse]

The Computers folder in the GP editor is not an OU; cannot add a GPO on it. It also has the computers attributes missing even though schema update was successful.
Update: the attributes are empty and the LAPS tab still does not have a password set other than the manual local admin added

[Spoonuk]

Definitely much better from Microsoft. The old LAPS was good but couldn't do DSRM and everything was plain text which was a pain. Is the GUI tool for LAPS still there? You could add it previously via control panel..

[buugedy]

Could you please recommend PS script, which would create laps.admin local user account on all domain computers?

What about DC, should there also be created same user laps.admin, or need to skip this step? Need to use only Administrator on a DC?

How to provide access for help desk unit to see that LAPS password? Their AD rights are very limited, ofcourse.

Thanks for video.

[mohitkaushik]

Its very helpful. But how would i manage system domain rejoin operations with Laps password.

[grapeape]

while this is good. It does not go over setting Laps-adread and adset permissions

[fbifido]

what if you don't have an AD?
what if you only have AAD?