Honolulu and LAPS

%3CLINGO-SUB%20id%3D%22lingo-sub-117338%22%20slang%3D%22en-US%22%3EHonolulu%20and%20LAPS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-117338%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20have%20tested%20the%20use%20of%20LAPS%20in%20Honolulu%20and%20yes%20it%20works%20as%20intended%20but%20our%20AD%20administrators%20are%20not%20happy%20with%20the%20way%20it%20has%20to%20be%20configured%20(delegation%20on%20the%20DCs).%3C%2FP%3E%3CP%3EWouldn't%20it%20be%20better%20to%20use%20a%20domain%20service%20account%20to%20run%20the%20Honolulu%20service%20and%20allow%20this%20service%20to%20read%20the%20LAPS%20attribute%20so%20it%20wouldn't%20be%20necessary%20to%20delegate%20rights%20%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20your%20answer%26nbsp%3B%3C%2FP%3E%3CP%3EMarc%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-117351%22%20slang%3D%22en-US%22%3ERe%3A%20Honolulu%20and%20LAPS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-117351%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20understand%20the%20concern%20and%20looking%20into%20different%20options%20to%20support%20LAPS.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

We have tested the use of LAPS in Honolulu and yes it works as intended but our AD administrators are not happy with the way it has to be configured (delegation on the DCs).

Wouldn't it be better to use a domain service account to run the Honolulu service and allow this service to read the LAPS attribute so it wouldn't be necessary to delegate rights ?

 

Thanks for your answer 

Marc

 

1 Reply

We understand the concern and looking into different options to support LAPS.