LAPS - not updating AD attributes for servers on particular OU

adr 46 Reputation points
2022-12-01T14:11:45.583+00:00

we have noticed that the servers in one of our OUs is not updating the local administrator password. All is working fine and as expected in all the other OUs. local administrator passwords on computers are being updated and the AD attributes ms-Mcs-AdmPwd and ms-Mcs-AdmPwdExpirationTime are updating OK.
on a server, for exmaple, i am unable to login as the local administrator (so im guessing the password has been updated?). the LAPS AD attributes also show as blank.
now, i suspect that the OU has not had the permissions updated for the computers.
my question is how do i check the existing configuration - ie. the OUs that 'Set-AdmPwdReadPasswordPermission' was run on?
any suggestions?

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
4,724 questions
Accepted answer
  1. Daisy Zhou 18,701 Reputation points Microsoft Vendor
    2022-12-02T04:29:59.647+00:00

    Hello alphadeltaromeo,

    Thank you for posting in our Q&A forum.

    Based on the description, I understand all the servers in an OU did not have LAPS password, but the servers have the AD attributes ms-Mcs-AdmPwd and ms-Mcs-AdmPwdExpirationTime.

    Whether it is a parent OU？ If so, please run the following commands first on DC (you can change Domain Admins to other administrator account or other admin group depending on your needs).

    Set-AdmPwdComputerSelfPermission -OrgUnit OUName
    Set-AdmPwdReadPasswordPermission -OrgUnit OUName -AllowedPrincipals "Domain Admins"
    Set-AdmPwdResetPasswordPermission -OrgUnit OUName -AllowedPrincipals "Domain Admins"

    Q: my question is how do i check the existing configuration - ie. the OUs that 'Set-AdmPwdReadPasswordPermission' was run on?
    A: Please check as below:

    1.Right click this OU and select Properties.
    2.Click Security tab and click Advanced button.
    3.Find if there is any entry that you configured on this OU.
    4.Click the entry if there is, and click Edit (but you do not need to edit it) button.
    5.Check if the specific group or user has Read ms-Mcs-AdmPwd and ms-Mcs-AdmPwdExpirationTime OR write ms-Mcs-AdmPwd and ms-Mcs-AdmPwdExpirationTime permissions ( if yes, the corresponding permissions should be Checked).

    Hope the information above is helpful.

    Best Regards,
    Daisy Zhou

    ===============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest