Enabling LAPS on Exchange Servers
I have three Exchange 2016 Servers in our on-prem AD environment, and have been in the process of deploying LAPS across our organisation's members servers. Unfortunately, I've been unable to get LAPS to work properly on our Exchange Servers. Or more accurately, I've been unable to get the AD Computer objects, which represent our Exchange Servers, to inherit permissions from their parent OUs. The outcome of this, is that members of our "LAPS Password Readers" security group cannot read the LAPS password stored in AD. Attempts to Mitigate I've gone into the Computer Object representing say MX1. In Security > Advanced, clicked Enable Inheritance. Then it works fine for a short amount of time, before Inheritance is disabled again. I've manually added the Read permission for the ms-Mcs-AdmPwd attribute on the specific MX1 Computer Object. Doesn't work at all, the permission gets wiped straight away. Of course, I've done a bit of research, but have found little evidence to show other people suffering from this same issue. In fact, Reddit users with on-prem Exchange and LAPS users https://www.reddit.com/r/sysadmin/comments/yppz8c/laps_on_exchange_server/. My research into the issue of non-inheritable AD permissions points me towards stuff regarding highly privileged / protected accounts, an adminCount attribute in AD, and SDPROP. All of my Exchange Servers have an adminCount attribute of 1, which I think is because they are indirectly members of BUILTIN\Administrators, through membership of the 'Exchange Trusted Subsystem' group. That is, each server is a member of 'Exchange Trusted Subsystem', and 'Exchange Trusted Subsystem' is a member of BUILTIN\Administrators. A Microsoft Appendix about https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory mentions the AdminSDHolder object, which provides the template permissions applied to protected AD objects. Should I add my LAPS Password Readers" security group to the AdminSDHolder object, giving it the necessary permissions to get LAPS working? I'm surprised I've not found any official guidance in the LAPS documents or elsewhere about this tbh... Any advice would be appreciated! Thanks, Alex