Windows LAPS architecture
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit d29c391 · +1 −9 lines · also on GitHub
⋯ 192 unchanged lines
193193
194194
The Windows LAPS-managed account is exempted when the "Interactive logon: Require Windows Hello for Business or smart card" policy (also known as SCForceOption) is enabled. See [Additional smart card Group Policy settings and registry keys](/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings#additional-smart-card-group-policy-settings-and-registry-keys).
195195
196
−Windows LAPS integration with the smart-card-auth-only policy is available on the following OS platforms with the specified update or later installed:
197
−
198
−- [Windows 11 22H2 - October 10 2023 Update](https://support.microsoft.com/help/5031354)
199
−- [Windows 11 21H2 - October 10 2023 Update](https://support.microsoft.com/help/5031358)
200
−- [Windows 10 - October 10 2023 Update](https://support.microsoft.com/help/5031356)
201
−- [Windows Server 2022 - October 10 2023 Update](https://support.microsoft.com/help/5031364)
202
−- [Windows Server 2019 - October 10 2023 Update](https://support.microsoft.com/help/5031361)
203
−
204196
## Windows LAPS OS image rollback detection and mitigation
205197
206198
When a live OS image is reverted to an earlier version, the result is often a “torn state” situation where the password stored in the directory no longer matches the password stored locally on the device. For example, the problem might occur when a Hyper-V virtual machine is restored to an earlier snapshot.
⋯ 5 unchanged lines
212204
This feature is only supported when backing passwords up to Active Directory. Microsoft Entra ID isn't supported.
213205
214206
> [!IMPORTANT]
215
−> The Windows LAPS OS image rollback detection and mitigation feature is supported in Windows 11 Insider Preview Build 26040 and later. The feature will not work until the latest Update-LapsADSchema PowerShell cmdlet is run, which adds the new msLAPS-CurrentPasswordVersion schema attribute to the Active Directory schema.
207
+> The Windows LAPS OS image rollback detection and mitigation feature is supported in Windows Server 2025 and later. The feature will not work until the latest Update-LapsADSchema PowerShell cmdlet is run, which adds the new msLAPS-CurrentPasswordVersion schema attribute to the Active Directory schema.
216208
217209
## See also
218210
⋯ 11 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:53 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.