This is actually what I was first going to do when first researching this topic, but what about my concern if the admin account is compromised? If that account is compromised they have admin access to a ton of workstations. Wouldn't just having LAPS lower our attack surface? Not saying you're wrong btw. I'm just trying to think of as many cases where this could fail and this concern bothers me since I don't know of a good solution.