Update Active Directory default schema with LAPS

Hello, Windows LAPS requires Active Directory schema update to be fully functional - such updates are often quite difficult to implement on large environments, due the amount of operational risks an...

JaySimmons

Microsoft

Feb 18, 2024

Hi Alban1998 ,

Thank you for your feedback. This is definitely an issue that I have considered. The only reason the new Windows LAPS schema was not already natively incorporated into the baseline AD schema is due to the out-of-band nature of when and how Windows LAPS was first backported. Given the timing of that backport (did not align with a Server OS release), I chose the simplest and most robust option which was to just ship a standalone cmdlet (Update-LapsADSchema) for this purpose.

Ignoring those background historical details :-), you are correct that the feature would be better off if the Windows LAPS schema was natively part of the base AD schema. I am tracking this work item but it probably will not make it in for Windows Server 2025.

thanks,

Jay