Set the DPAPI backup keys rotation period

Policy ID: DomainBackupKeyRotationPeriod
Scope: Computer Configuration
Supported on: At least Windows Server 2016
Source: Administrative Templates (.admx) for Windows 11 2026 Update (26H2) (version 1.0)
Category: System › DPAPI

Description

This policy setting specifies the DPAPI backup keys rotation period.
You can use this setting to override the default value of 90 days. Set 0 to disable the DPAPI backup keys rotation.
If you enable this policy setting, set the number of days that the system waits before generating a new DPAPI backup key.
If you disable or do not configure this policy setting, the default value of 90 days is used.

Options

Specify the DPAPI backup keys rotation period in days. Set 0 to disable the DPAPI backup keys rotation.

Registry

ComputerHKEY_LOCAL_MACHINE

HKLM\Software\Policies\Microsoft\Windows\DPAPI View registry values

DomainBackupKeyRotationPeriodREG_DWORD

Other policies in the same category

View all policies in this category (1)