The first time it is used, we have to manually type the domain\localadmin password. After that it is stored in credential manager.

And easy enough to resolve once I look. @EddieJennings you should have reminded me to look more earlier.. /etc/sudoers has it commented out. ## Allows people in group wheel to run all commands # %wheel ALL=(ALL) ALL ## Same thing without a password # %wheel ALL=(ALL) NOPASSWD: ALL