Windows LAPS architecture
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 2956b10 · +1 −1 lines · also on GitHub
⋯ 170 unchanged lines
171171
> [!IMPORTANT]
172172
> When DSRM password backup is enabled, the current DSRM password for any domain controller is retrievable if at least one domain controller in that domain is accessible.
173173
>
174
−> But consider a catastrophic scenario in which all the domain controllers in a domain are down. In this scenario, no DSRM passwords will be available. For this reason, we recommend that you use Windows LAPS DSRM support as only the first component of a larger domain backup and recovery strategy. We strongly recommend that DSRM passwords be regularly extracted from the directory and backed up to a secure store outside Windows Server Active Directory. Windows LAPS doesn't include an external store backup strategy.
174
+> Consider a catastrophic scenario in which all the domain controllers in a domain are down. In that situation, as long as you have been maintaining regular backups per Active Directory best practices, you can still recover DSRM passwords from backups using the procedure outlined in [Retrieving passwords during AD disaster recovery scenarios](laps-scenarios-windows-server-active-directory.md#retrieving-passwords-during-ad-disaster-recovery-scenarios.)
175175
176176
## Password reset after authentication
177177
⋯ 47 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:53 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.