Page 124 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
Microsoft documents migration from legacy Microsoft LAPS to Windows LAPS. Side-by-side coexistence is possible only when the two policies target different local accounts, and migration away from legacy LAPS remains the goal.
Read the checklist
Get-LapsADPassword queries Active Directory, Reset-LapsPassword initiates immediate rotation, and Set-LapsADAuditing configures Windows LAPS auditing on Active Directory organizational units.
Read the explainer
Windows LAPS records its operations in a dedicated LAPS Operational event-log channel. Key events cover policy processing, configuration, password updates, blocked external changes, and post-authentication actions.
Read the guide
AD-backed Windows LAPS requires new forest schema elements installed with Update-LapsADSchema. The schema includes separate attributes for expiration, clear password, encrypted password, history, and encrypted DSRM password.
Read the playbook
The TPM enters lockout to resist tampering or repeated malicious authorization attempts. During lockout it rejects authorization-dependent commands but preserves at least one owner attempt to reset lockout.
Read the briefing
Windows exposes TPM Services policy under Computer Configuration administrative templates. The policies control blocked TPM commands, owner-authorization availability, and standard-user lockout duration and thresholds.
Read the checklist
Kernel DMA Protection prevents unauthorized memory access by external DMA-capable peripherals. Thunderbolt, USB4, and CFexpress devices can access memory without CPU involvement, creating drive-by DMA risk.
Read the explainer
System Guard Secure Launch and SMM protection improve Windows startup security. Secure Launch requires a supported processor and Microsoft documents how to verify that it is configured and running.
Read the guide
Advanced audit settings reside under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → System Audit Policies and are available through Local Security Policy or Group Policy.
Read the playbook
BitLocker policy can place a custom recovery message and URL on the preboot screen, including a self-service recovery portal, internal support site, or support phone number.
Read the briefing