Local Administrator Password Solution (LAPS) Implementation Hints and Security Nerd Commentary (including mini threat model)

I wanted to update my situation. I had modified the searchFlags attribute of the ms-Mcs-AdmPwd schema object to the incorrect value, so all users were able to see it. Once I changed it to the correct value, permission worked as it should.