Page 138 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
A root CA self-signs at the top of the PKI hierarchy, so its renewal preserves continued trust. Microsoft documents renewal with an existing or new key pair and makes root-CA backup the first procedure step.
Read the playbook
Windows policy can reject X.509 certificates that use MD5, SHA-1, or undersized RSA keys. The policy affects certificate validation for TLS, code signing, and other Windows certificate scenarios and includes logging support.
Read the briefing
Windows LAPS automatically manages and backs up a local administrator password for Entra-joined or AD-joined devices. It can also manage and back up the DSRM account password on AD domain controllers.
Read the checklist
Windows LAPS has a defined background policy-processing cycle that controls password operations. Its architecture separates Microsoft Entra password backup from Windows Server AD password backup.
Read the explainer
Windows LAPS supports distinct manual and automatic local-account management modes. Automatic account management requires Windows 11 24H2, Windows Server 2025, or later.
Read the guide
Windows LAPS can generate random passwords or random passphrases for managed accounts. Microsoft documents the available character sets, passphrase word lists, and entropy considerations.
Read the playbook
The AD-backed Windows LAPS workflow updates the schema and grants managed devices permission to write their passwords. A domain functional level earlier than 2016 cannot use Windows LAPS password encryption.
Read the briefing
Microsoft documents migration from legacy Microsoft LAPS to Windows LAPS. Side-by-side coexistence is possible only when the two policies target different local accounts, and migration away from legacy LAPS remains the goal.
Read the checklist
Get-LapsADPassword queries Active Directory, Reset-LapsPassword initiates immediate rotation, and Set-LapsADAuditing configures Windows LAPS auditing on Active Directory organizational units.
Read the explainer
Windows LAPS records its operations in a dedicated LAPS Operational event-log channel. Key events cover policy processing, configuration, password updates, blocked external changes, and post-authentication actions.
Read the guide