Windows LAPS

[@kyleduncan2349]

Very helpful! Thanks for explaining this clearly. This is way easier than setting up Legacy LAPS.

[@fbifido2]

the local Admin username is still "Administrator"? can LAPS rename/randomized this account as well?

[@ninjaowl9881]

This was awesome, thank you for posting this! Helped me out.

[@Spoonuk666]

Definitely much better from Microsoft. The old LAPS was good but couldn't do DSRM and everything was plain text which was a pain. Is the GUI tool for LAPS still there? You could add it previously via control panel..

[@PeteNetLive]

AFAIK - only the computer object and PS.

[@HestnetIT]

I can confirm that the old GUI tool is not compatible with the new LAPS.

[@NevaranUniverse]

The Computers folder in the GP editor is not an OU; cannot add a GPO on it. It also has the computers attributes missing even though schema update was successful. Update: the attributes are empty and the LAPS tab still does not have a password set other than the manual local admin added

[@JoshuaWilson-t4k]

I ran through these steps exactly, but LAPS doesn't appear for me under Group Policy Management Editor. Any idea why this might be?

[@N3wStud3nt]

Did anyone figure out why this happens?

[@mohitkaushik1104]

Its very helpful. But how would i manage system domain rejoin operations with Laps password.

[@grapeape1968]

while this is good. It does not go over setting Laps-adread and adset permissions

[@buugedy]

Could you please recommend PS script, which would create laps.admin local user account on all domain computers? What about DC, should there also be created same user laps.admin, or need to skip this step? Need to use only Administrator on a DC? How to provide access for help desk unit to see that LAPS password? Their AD rights are very limited, ofcourse. Thanks for video.

[@fbifido2]

what if you don't have an AD? what if you only have AAD?

[@HestnetIT]

LAPS can be used in an AAD-only environment. Of course, the process to set it up and manage it will be different.