Page 61 of the DSE Microsoft 365 & Identity knowledge center, with source-backed guidance and practical next steps.
Clear guidance for Microsoft 365, Entra identity, account protection, collaboration, endpoint policy, and lifecycle changes.
Windows LAPS has a defined background policy-processing cycle that controls password operations. Its architecture separates Microsoft Entra password backup from Windows Server AD password backup.
Read the explainer
Windows LAPS supports distinct manual and automatic local-account management modes. Automatic account management requires Windows 11 24H2, Windows Server 2025, or later.
Read the guide
Windows LAPS can generate random passwords or random passphrases for managed accounts. Microsoft documents the available character sets, passphrase word lists, and entropy considerations.
Read the playbook
The AD-backed Windows LAPS workflow updates the schema and grants managed devices permission to write their passwords. A domain functional level earlier than 2016 cannot use Windows LAPS password encryption.
Read the briefing
Microsoft documents migration from legacy Microsoft LAPS to Windows LAPS. Side-by-side coexistence is possible only when the two policies target different local accounts, and migration away from legacy LAPS remains the goal.
Read the checklist
Get-LapsADPassword queries Active Directory, Reset-LapsPassword initiates immediate rotation, and Set-LapsADAuditing configures Windows LAPS auditing on Active Directory organizational units.
Read the explainer
Windows LAPS records its operations in a dedicated LAPS Operational event-log channel. Key events cover policy processing, configuration, password updates, blocked external changes, and post-authentication actions.
Read the guide
AD-backed Windows LAPS requires new forest schema elements installed with Update-LapsADSchema. The schema includes separate attributes for expiration, clear password, encrypted password, history, and encrypted DSRM password.
Read the playbook
Defender for Identity sensors collect signals from on-premises identity infrastructure for threat detection. The service detects activity such as privilege escalation and high-risk lateral movement and reports exploitable identity issues such as unconstrained Kerberos delegation.
Read the playbook
The sensor v3.x is deployed on supported domain controllers. Microsoft directs administrators to complete prerequisite checks before activation and configure auditing and identity settings afterward.
Read the briefing