-
Title
Copying or Nesting the Built-in "Computer Objects – Read/Write LAPS Settings" Access Template Does Not Work -
Description
Active Roles Administrators may attempt to create a copy of the built-in "Computer Objects – Read/Write LAPS Settings" Access Template, renaming it or nesting it inside another Access Template, in order to customize scoping, naming conventions, or trustee assignments before linking it to an OU.
After the copied or nested template is linked to the target OU with the appropriate trustee group, the LAPS attributes remain inaccessible on computer objects within that scope.
The LAPS tab on affected computer objects reports
"LAPS is not available in your environment. This can occur if LAPS is not fully configured in your organization."
-
Cause
Active Roles unlocks the LAPS attributes on computer objects only when the original built-in "Computer Objects – Read/Write LAPS Settings" Access Template is applied. The product identifies this specific template internally by a fixed internal ID (GUID), not by the permissions the template contains.
When an administrator creates a copy of the built-in template or nests it inside another Access Template, the copy is assigned a different GUID at creation time. Even though the copy carries exactly the same LAPS-related permissions, Active Roles does not recognize it as the LAPS template and ignores it.
This behavior is specific only to Computer Objects – Read/Write LAPS Settings AT and by design and has been introduced in Active Roles 8.4. All other Access Templates continue to support copying and nesting as expected - LAPS is the only exception.
-
Resolution
To make the LAPS attributes available through Active Roles, link the original built-in "Computer Objects – Read/Write LAPS Settings" Access Template directly to the target OU (or other container), and assign the appropriate trustee at the point of linking.
Do not create or use a copy of the built-in LAPS template. Copies and nested references will never unlock the LAPS attributes, regardless of the permissions they contain, because the copy carries a different internal GUID than the one Active Roles expects.