Guys -

I use LAPS, deployed using KACE and a GPO to set it up.

LAPS is from Microsoft - Local Administrator Password Solution - works awesome!  Shame more people don't know about it!

https://technet.microsoft.com/en-us/mt227395.aspx

Will cycle passwords too based on a schedule defined in GPO...so you no longer need to manage anything!  All passwords are random so no two machine have same local admin password.

Passwords are stored in the AD computer object - with a GUI to retrieve them when needed. 

Check it out!