[SOLVED] Local admin account does not work anymore on domain joined client computer

[ddrunk525]

Hello, I need help. I have a windows server 2016 DC with about 24 users currently, all connecting with their domain joined laptops. Everything has worked fine until about a month ago.

When a user has an issue that requires elevated access to resolve, I usually just use the local admin account on the system. About a month ago, I tried the same way and the password kept getting denied. Even when I tried to reset the password using the "forgot password" option provided by windows, after answering all the security questions and entering a new password, I would get a failed error message.

I eventually had to reset it using one of the tools on Hiren's BootCD. I thought it was a one of situation, but I have just realized 9 of the computers have the same issue. None of the local admin account passwords work for any of the computers. All the computers use Windows 10 Pro for Workstation.

Does anyone have any idea what could be wrong?

PS: Testing the other computers to see if they are affected too.

 

[velocityg4]

What's your password policy? Are they set to expire after a certain number of days?

 

[ddrunk525]

There isn't any for the local admin account. It is not set to expire.. But even if it expired, I believe i should get a prompt to that effect and to change it as well. But that is not the case. the system just wont accept the password.

 

[ddrunk525]

Apparently, the May 2023 update of Windows 10 came with a native LAPs client.

A LAPS GPO that I had abandoned(cos it wasn't working at the time), got triggered changed the passwords.
Used Get-LapsADPassword -Identity "computername" -AsPlainText to show the active password.