BitLocker recovery vs Windows LAPS vs DSRM password: three local credentials, three gotchas

This sheet compares BitLocker recovery password, Windows LAPS local admin account, DSRM administrator password.

CriterionBitLocker recovery passwordWindows LAPS local admin accountDSRM administrator password
Needed or triggered whenA protected OS drive boots on hardware whose TPM measurements have changed - the drive is moved to a different computer, or the motherboard is upgraded to a new one with a new TPMThe AdministratorAccountName policy setting names a custom local accountA domain controller must boot into Directory Services Restore Mode

The verdict, the full comparison, 3 rules and 3 traps are part of AZ-802 access. Unlock AZ-802.