Set-AdmPwdReadPasswordPermission Identity Reference issue

Question

I am attempting to deploy LAPS on a 2012R2 domain controller

I am running through microsoft's official configuration guide and I'm stuck at section 2.2.3

Set-AdmPwdReadPasswordPermission -OrgUnit <name of the OU to delegate permissions> -AllowedPrincipals <users or groups>

I am running this command, but it errors out

Answer 1

Hi

Are you sure that the group name is correct ?

Try launch the following command:

$AdminUser = Get-ADGroup -identity "domain administrators" -Server "domain.lan"

$ADAccount = $AdminUser.SID.Translate([System.Security.Principal.NTAccount])

Set-AdmPwdReadPasswordPermission -OrgUnit <name of the OU to delegate permissions> -AllowedPrincipals $ADAccount

Please don't forget to mark helpful reply as answer

Answer 2

Hi @ConstructionComputing ,

can you please try putting also the domain name there:

Set-AdmPwdReadPasswordPermission -OrgUnit <name of the OU to delegate permissions> -AllowedPrincipals "DomainNetBIOS\Domain Administrators"  

Does this work?

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Stoyan Chalakov