LAPS is usually only enabled on specific OUs. allow to specify a list of OUs where to use the LAPS password for remote administration or the ability to have a credential entry at the OU level instead of just the actual domain level.