LAPS Restrict Domain Controller

Question

Hi,

My environment configured with LAPS and usually it query laps password from few domain controllers.

Could it possible to restrict 1 or 2 dedicated domain controllers to respond towards laps password queries from client?

Is there any registry in client to control that? or any DC query priority in laps?

Thanks mate.

Answer 1

Hello Tan Han Lim,

Thank you for your question and for reaching out with your question today.

When configuring LAPS you can deploy it to whichever DCs you would like it to be functional on. This would have been carried out in your environment at initial setup and if LAPS requests are accepted by multiple DCs, I would assume that LAPS was deployed to all of your DCs. In my experience, I would deploy LAPS to only my main DC as having it on multiple DCs can cause issues in an environment.

If the reply was helpful, please don’t forget to upvote or accept as answer.

Best regards.