HomeLessons Learned

Technical source document

Lessons Learned

Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.

Original GitHub document All documentation

Lessons Learned

  • Verify msLAPS-* schema state before running Update-LapsADSchema.
  • Use temporary privilege for schema changes and remove it immediately afterward.
  • Scope testing to a dedicated OU rather than broad workstation containers.
  • Separate LAPS password-read rights from Domain Admin privileges.
  • Prefer encrypted password storage and an explicit decryptor group.
  • Select the managed account intentionally; LAPS can rotate a disabled account, but that does not make the account usable for recovery.
  • Event IDs 10021, 10020, 10018, 10014, and 10004 provide strong operational evidence.
  • gpresult and GUI RSOP validate complementary layers of Group Policy application.
  • Troubleshoot the failing layer from evidence: transport, WMI/RPC, firewall policy source, policy application, and finally LAPS processing.
  • Portfolio evidence should show timestamps, source, account, decryption status, and authorization metadata while excluding the password itself.