Windows LAPS architecture
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit fcff787 · +15 −1 lines · also on GitHub
⋯ 186 unchanged lines
187187
188188
## Disabled in Windows safe mode
189189
190
−When Windows is started in safe mode, DSRM mode, or in any other non-default boot mode, Windows LAPS is disabled and no passwords are backed up.
190
+When Windows is started in safe mode, DSRM mode, or in any other non-normal boot mode, Windows LAPS is disabled. The managed account's password won't backed up during this time even if it is in an expired state.
191191
192192
## Windows LAPS integration with smart card policy
193193
⋯ 7 unchanged lines
201201
- [Windows Server 2022 - October 10 2023 Update](https://support.microsoft.com/help/5031364)
202202
- [Windows Server 2019 - October 10 2023 Update](https://support.microsoft.com/help/5031361)
203203
204
+## Windows LAPS OS image rollback detection and mitigation
205
+
206
+When a live OS image is reverted to an earlier version, the result is often a “torn state” situation where the password stored in the directory no longer matches the password stored locally on the device. For example, the problem might occur when a Hyper-V virtual machine is restored to an earlier snapshot.
207
+
208
+Once the problem occurs, the IT admin is unable to sign into the device using the persisted Windows LAPS password. The problem isn't resolved until Windows LAPS rotates the password, but this repair might not occur for days or weeks depending on the password expires.
209
+
210
+Windows LAPS solves this problem by writing a random GUID to the directory at the same time a new password is being persisted, followed by saving a local copy. The GUID is stored in the msLAPS-CurrentPasswordVersion attribute. During every processing cycle, the msLAPS-CurrentPasswordVersion guid is queried and compared to the locally persisted copy. If the two GUIDs are different, the password is immediately rotated.
211
+
212
+This feature is only supported when backing passwords up to Active Directory. Microsoft Entra ID isn't supported.
213
+
214
+> [!IMPORTANT]
215
+> The Windows LAPS OS image rollback detection and mitigation feature is only supported in Windows 11 Insider Preview Build 26022 and later. The feature will not work until the latest Update-LapsADSchema PowerShell cmdlet is run, which adds the new msLAPS-CurrentPasswordVersion schema attribute to the Active Directory schema.
216
+
204217
## See also
205218
206219
- [Windows LAPS account management modes](laps-concepts-account-management-modes.md)
220
+- [Windows LAPS passwords and passphrases](laps-concepts-passwords-passphrases.md)
207221
- [CNG DPAPI](/windows/win32/seccng/cng-dpapi)
208222
- [Microsoft Intune](/mem/intune)
209223
⋯ 6 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:53 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.