needs to be updated to add two new attributes:ms-MCS-AdmPwd Stores the password in clear textms-MCS-AdmPwdExpirationTime Stores the time to reset the passwordI can already hear the wheels turning on the clear text part. When the password is changed the communication is encrypted with Kerberos encryption. We will cover restricting its viewing it in Active Directory in a just a minute.** Just to make sure you didnt just skim over the first part to get to the meat of the article, let me just say one more time that you should be testing this in a LAB environment first**Okay, back to the good stuff. To update the Schema you first need to import the PowerShell module. Open up an Administrative PowerShell window and use this command:Import-module AdmPwd.PSNow you can update the Schema with this command:Update-AdmPwdADSchemaDelegation of permissions on computer accountsThe next step is to remove all extended rights/permissions from users and groups that are not allowed to read the value of attribute ms-MCS-AdmPwd. This is required because the All Extended rights/permissions permission also gives permission to read confidential attributes. If you want to do this for all computers you will need to repeat the next steps on each OU that contains those computers. You do not need to do this on subcontainers of already processed OUs.1. Open ADSIEdit2. Right Click on the OU that contains the computer accounts that you are installing this solution on and select Properties.3. Click the Security tab4. Click Advanced5. Select the Group(s) or User(s) that you dont want to be able to read the password and then click Edit.6. Uncheck All extended rightsImportant: This will remove ALL extended rights, not only CONTROL_ACCESS right, so be sure that all roles will retain all necessary permissions required for their regular work.Next we need to add the Write permission on ms-MCS-AdmPwdExpirationTime and ms-MCS-AdmPwd attributes of all computer accounts to the SELF built-in account. This is required so the machine can update the password and expiration timestamp of its own built-in Administrator password. We can use PowerShell to do this.Set-AdmPwdComputerSelfPermission -OrgUnit In my case the OU name was Servers. Repeat this for any additional OUs that contain computer accounts you want this solution to apply to.Now add the CONTROL_ACCESS permission on ms-MCS-AdmPwd attribute of the computer accounts to group(s) or user(s) that will be allowed to read the stored password of the built-in Administrator account on managed computers.Set-AdmPwdReadPasswordPermission -OrgUnit -AllowedPrincipals Use the same OrgUnit name(s) as in the previous command.Note: You can use multiple groups and users in the same command separated by comma.Ex: Set-AdmPwdReadPasswordPermission -OrgUnit Servers -AllowedPrincipals domain2\Administrator,domain2\HelpDesk,domain2\Group3Lastly we need to add the Write permission on ms-MCS-AdmPwdExpirationTime attribute of computer accounts to group(s) or user(s) that will be allowed to force password resets for the built-in Administrator account on managed computers.Set-AdmPwdResetPasswordPermission -OrgUnit -AllowedPrincipals Again, use the same OrgUnit name(s) as in the previous commands. You can still use multiple groups and users in the same command separated by comma.Registration of CSE with chosen Group Policy ObjectWhat makes all of this work is a Group Policy client side extension that runs on