Set the DPAPI backup keys rotation period: registry value DomainBackupKeyRotationPeriodComputerHKLM\Software\Policies\Microsoft\Windows\DPAPI
- Policy ID
- DomainBackupKeyRotationPeriod
- Scope
- Computer Configuration
- Supported on
- At least Windows Server 2016
- Source
- Administrative Templates (.admx) for Windows 11 2026 Update (26H2) (version 1.0)
- Category
- System › DPAPI
Registry
DomainBackupKeyRotationPeriod
REG_DWORDComputerHKLM\Software\Policies\Microsoft\Windows\DPAPI Current key
- Enabled value
- Depends on the option value
- Element
- Specify the DPAPI backup keys rotation period in days. Set 0 to disable the DPAPI backup keys rotation.
- Value type
- REG_DWORD
- Minimum value
- 0
- Maximum value
- 18262
Apply with .reg · CMD · PowerShell
.reg
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DPAPI] ; Value names and types follow the ADMX. Replace <enter value> below with your own data "DomainBackupKeyRotationPeriod"=dword:<enter value>
CMD
:: Value names and types follow the ADMX. Replace <enter value> below with your own data reg add "HKLM\Software\Policies\Microsoft\Windows\DPAPI" /v "DomainBackupKeyRotationPeriod" /t REG_DWORD /d "<enter value>" /f
PowerShell
# Value names and types follow the ADMX. Replace <enter value> below with your own data New-Item -Path 'HKLM:\Software\Policies\Microsoft\Windows\DPAPI' -Force | Out-Null New-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Windows\DPAPI' -Name 'DomainBackupKeyRotationPeriod' -PropertyType DWord -Value '<enter value>' -Force | Out-Null