It is about a year from when Microsoft released LAPS (Local Administrator Password Solution). This is a great tool for keeping your local admins under control and secure.
As we know, a lot of local accounts have weak passwords and we don’t care about this. This’s dangerous! Even if you have a weak local admin password, you can still break a PC with him. If you have the same password for local admins in entire environment, you can have a problem when someone knows this password… Thinking in this way, we have a lot of reasons why to use LAPS. And it is simple to install and use it; it is true that will extend AD schema, but don’t care about this – it is not critical.
LAPS is downloadable from here and it is FREE. Here is also nice post how to install and configure it and this is all you need.
The only problem that I had is enabling and renaming local admin account true GPO, but here is also a very easy trick:
When I install client operating system thru MDT or System Center, I always disable admin account in the last step. It is more secure, but you can have problems if something goes wrong with computer relationship in domain. If you have the same situation, you have to enable Account in Group policy setting Computer Configuration > Polices > Windows Settings > Security Settings > Local Polices > Security Options by enabling setting Accounts: Administrator Account Status. After doing this, it is suggested also to rename Administrator account. This could be done in the same place with setting Account: Rename Administrator account or thru Group policy preferences.
