Microsoft's Local Administrator Password Solution (LAPS) is a great product for large monolithic organizations that have complete control over their domain joined Windows clients... but what about those of us that have more "liberal" users and expectations (technical debt)? We have come up with a solution that allows our domain joined clients to still be protected, without angering the previously delegated administrators (and in most cases, they don't even know it is happening, yet it is hidden in plain sight).