Page 235 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
Windows LAPS has a defined background policy-processing cycle that controls password operations. Its architecture separates Microsoft Entra password backup from Windows Server AD password backup.
Read the explainer
Windows LAPS supports distinct manual and automatic local-account management modes. Automatic account management requires Windows 11 24H2, Windows Server 2025, or later.
Read the guide
Windows LAPS can generate random passwords or random passphrases for managed accounts. Microsoft documents the available character sets, passphrase word lists, and entropy considerations.
Read the playbook
The AD-backed Windows LAPS workflow updates the schema and grants managed devices permission to write their passwords. A domain functional level earlier than 2016 cannot use Windows LAPS password encryption.
Read the briefing
Microsoft documents migration from legacy Microsoft LAPS to Windows LAPS. Side-by-side coexistence is possible only when the two policies target different local accounts, and migration away from legacy LAPS remains the goal.
Read the checklist
Get-LapsADPassword queries Active Directory, Reset-LapsPassword initiates immediate rotation, and Set-LapsADAuditing configures Windows LAPS auditing on Active Directory organizational units.
Read the explainer
Windows LAPS records its operations in a dedicated LAPS Operational event-log channel. Key events cover policy processing, configuration, password updates, blocked external changes, and post-authentication actions.
Read the guide
AD-backed Windows LAPS requires new forest schema elements installed with Update-LapsADSchema. The schema includes separate attributes for expiration, clear password, encrypted password, history, and encrypted DSRM password.
Read the playbook
The TPM enters lockout to resist tampering or repeated malicious authorization attempts. During lockout it rejects authorization-dependent commands but preserves at least one owner attempt to reset lockout.
Read the briefing
Windows exposes TPM Services policy under Computer Configuration administrative templates. The policies control blocked TPM commands, owner-authorization availability, and standard-user lockout duration and thresholds.
Read the checklist