The Windows LAPS password history is a privilege boundary, and its ACL is the thing to review

LAPS replaces a shared password with an escrowed one; the delegation of that escrow is the new control.