Merge pull request #7842 from MicrosoftDocs/copilot/update-laps-attribute-documentation

Clarify msLAPS-CurrentPasswordVersion requires Windows Server 2025 forest schema

Author: prmerger-automator[bot]

WindowsServerDocs/identity/laps/laps-concepts-overview.md

@@ -234,7 +234,7 @@ This feature is only supported when backing passwords up to Active Directory. Mi
 > Windows LAPS rollback detection and mitigation can only work if the machine still has a valid computer account password and is capable of authenticating to Active Directory. That condition may or may not be true depending on the mismatched state caused by the rollback. If the machine is no longer capable of authenticating, other recovery steps will be required such as resetting the machine account password. The Windows LAPS account on the reverted machine may still be useful if the Windows LAPS password history feature has been enabled.
 
 > [!IMPORTANT]
-> The Windows LAPS OS image rollback detection and mitigation feature is supported in Windows 11 24H2, Windows Server 2025 and later. The feature will not work until the latest Update-LapsADSchema PowerShell cmdlet is run, which adds the new msLAPS-CurrentPasswordVersion schema attribute to the Active Directory schema.
+> The Windows LAPS OS image rollback detection and mitigation feature is supported in Windows 11 24H2, Windows Server 2025 and later. This feature requires the `msLAPS-CurrentPasswordVersion` schema attribute, which is only available when using the Windows Server 2025 forest schema. This attribute is automatically included when you promote the first Windows Server 2025 domain controller in your forest; it's not installed by running the `Update-LapsADSchema` cmdlet.
 
 ## See also
 

WindowsServerDocs/identity/laps/laps-technical-reference.md

@@ -153,6 +153,9 @@ SearchFlags: 904
 AttributeSecurityGuid: f3531ec6-6330-4f8e-8d39-7a671fbac605 (ms-LAPS-Encrypted-Password-Attributes)
 ```
 
+> [!IMPORTANT]
+> The `msLAPS-CurrentPasswordVersion` attribute is only available when using the Windows Server 2025 forest schema. This attribute is automatically included when you promote the first Windows Server 2025 domain controller in your forest; it's not installed by running the `Update-LapsADSchema` cmdlet. If your forest doesn't have at least one Windows Server 2025 domain controller, this attribute won't be available and the [OS image rollback detection and mitigation](laps-concepts-overview.md#windows-laps-os-image-rollback-detection-and-mitigation) feature won't function.
+
 ## Extended rights
 
 Windows LAPS extends the `ms-LAPS-Encrypted-Password-Attributes` rights in Windows Server Active Directory. You can use the `ms-LAPS-Encrypted-Password-Attributes` extended rights to grant managed devices SELF permissions to read and write various attributes that are described in the preceding sections.