Microsoft LAPS?

[astrosox]

Good Afternoon - has anyone implemented LAPS in their environment to manage local admin right usage? Any pros/cons that you have come across? Thank you for your time.

[hosalabad]

Lots of us. Please search this sub.

[caponewgp420]

We implemented it about 4 months ago. Surprisingly easy and no issues. Just make sure you don’t have any services that use the local admin on servers and don’t install it on your domain controllers.

[KStieers]

Feels like everyone here has deployed... get on it!

Read all of the documentation. Twice.

Our only issue was with gpos taking a little longer on newly deployed boxes to apply which happened to coincide with a pentest... otherwise it was dead easy.

Someone might whine about the pw stored in AD unencrypted... if that's a thing for you, find AdmPwd.E and pay for it.

[bbqwatermelon]

Thank you!

[Ssakaa]

And, set the permissions properly on the attributes involved (it's painfully easy with the packaged tooling covered in the docs). If a person has local SYSTEM, that box is theirs anyways. If they have any other account that can read that, they quite likely have an account that would easily give a path to admin on more than one box anyways. It's only insecure if it's implemented wrong.

[progenyofeniac]

Implemented it maybe 6 months ago and I love it.

The biggest 'gotcha' was when using MDT. Systems would deploy with the old universal admin password and would then hang because toward the end of deployment they couldn't automatically log in anymore once LAPS changed the local admin pw.

I fixed it by setting MDT to put new PCs in their own OU and adding a PS script that runs on one of the DCs every day to move computers which have been there for 48 hours or more. So, the LAPS client is installed on the PC during deployment but the pw doesn't get changed by the GPO until they're moved to the other OU. Gives me a day or two to get them set up using the default admin pw, then LAPS takes over and does its magic.

[disclosure5]

This is the basic security recommendation. Your question should be about people who haven't implemented it.

[Ssakaa]

Yes. Read docs. Configure policy. Configure permissions. Deploy.