Local Administrator Password Management (LAPS) on Server 2016

[BethlehemNY]

Active Directory (small), one forest, two domain controllers. DC1 is the master for all roles (netdom query fsmo). Should LAPS (AdmPwd.Setup.x64.msi) be installed on DC1 or DC2 or does it matter? Should we do a full install on both DCs? Can LAPS be installed on a domain controller during business hours with no effect on users? Can the schema be updated during business hours with no effect on users? Does the schema need to be updated on both DCs?

Continue reading...