Do not allow storage of passwords and credentials for network authentication

๐Ÿ”’ย Secure Bits ๐Ÿ’ก
โ€œ๐——๐—ผ ๐—ป๐—ผ๐˜ ๐—ฎ๐—น๐—น๐—ผ๐˜„ ๐˜€๐˜๐—ผ๐—ฟ๐—ฎ๐—ด๐—ฒ ๐—ผ๐—ณ ๐—ฝ๐—ฎ๐˜€๐˜€๐˜„๐—ผ๐—ฟ๐—ฑ๐˜€ ๐—ฎ๐—ป๐—ฑ ๐—ฐ๐—ฟ๐—ฒ๐—ฑ๐—ฒ๐—ป๐˜๐—ถ๐—ฎ๐—น๐˜€ ๐—ณ๐—ผ๐—ฟ ๐—ป๐—ฒ๐˜๐˜„๐—ผ๐—ฟ๐—ธ ๐—ฎ๐˜‚๐˜๐—ต๐—ฒ๐—ป๐˜๐—ถ๐—ฐ๐—ฎ๐˜๐—ถ๐—ผ๐—ปโ€ โ€” harmless sounding, right?

Well, It is good to think twice before enabling Security Baselines blindly.

๐Ÿ›‘ This setting disablesย whether Credential Manager saves passwords and credentials, which can break more than you expect.

๐Ÿ’ฅย ๐—ช๐—ต๐—ฎ๐˜ ๐—ถ๐˜ ๐—ถ๐—บ๐—ฝ๐—ฎ๐—ฐ๐˜๐˜€:
โŒย DFS shareย mapping stops working (normal SMB shares are fine)
โŒย Scheduled Tasksย with stored creds fail (unless using MSA/GMSA/DMSA)
โŒย RDPย wonโ€™t store credentials (better to use Restricted Admin mode or Remote Credential Guard anyway in combination with a good AD design)

๐Ÿ“ย ๐—ฃ๐—ผ๐—น๐—ถ๐—ฐ๐˜† ๐—ฝ๐—ฎ๐˜๐—ต:
Computer ConfigurationWindows SettingsSecurity SettingsLocal PoliciesSecurity Options
โ†’ย ๐—ก๐—ฒ๐˜๐˜„๐—ผ๐—ฟ๐—ธ ๐—ฎ๐—ฐ๐—ฐ๐—ฒ๐˜€๐˜€: ๐——๐—ผ ๐—ป๐—ผ๐˜ ๐—ฎ๐—น๐—น๐—ผ๐˜„ ๐˜€๐˜๐—ผ๐—ฟ๐—ฎ๐—ด๐—ฒ ๐—ผ๐—ณ ๐—ฝ๐—ฎ๐˜€๐˜€๐˜„๐—ผ๐—ฟ๐—ฑ๐˜€ ๐—ฎ๐—ป๐—ฑ ๐—ฐ๐—ฟ๐—ฒ๐—ฑ๐—ฒ๐—ป๐˜๐—ถ๐—ฎ๐—น๐˜€ ๐—ณ๐—ผ๐—ฟ ๐—ป๐—ฒ๐˜๐˜„๐—ผ๐—ฟ๐—ธ ๐—ฎ๐˜‚๐˜๐—ต๐—ฒ๐—ป๐˜๐—ถ๐—ฐ๐—ฎ๐˜๐—ถ๐—ผ๐—ป

โœ… ๐—ฌ๐—ผ๐˜‚ ๐—ฑ๐—ผ ๐˜„๐—ฎ๐—ป๐˜ ๐˜๐—ต๐—ถ๐˜€ ๐—ฒ๐—ป๐—ฎ๐—ฏ๐—น๐—ฒ๐—ฑ โ€” ๐—ถ๐˜โ€™๐˜€ ๐—ฎ ๐˜€๐—ผ๐—น๐—ถ๐—ฑ ๐˜€๐—ฒ๐—ฐ๐˜‚๐—ฟ๐—ถ๐˜๐˜† ๐—บ๐—ฒ๐—ฎ๐˜€๐˜‚๐—ฟ๐—ฒ.
But you should also understand the real-world tradeoffs and know when an exception might be needed.

๐—œ ๐—ฐ๐—ผ๐˜ƒ๐—ฒ๐—ฟ ๐—ต๐—ผ๐˜„ ๐˜๐—ผ ๐—ฎ๐—ฝ๐—ฝ๐—น๐˜† ๐˜€๐—ฒ๐—ฐ๐˜‚๐—ฟ๐—ถ๐˜๐˜† ๐—ฏ๐—ฎ๐˜€๐—ฒ๐—น๐—ถ๐—ป๐—ฒ๐˜€ properly (with the why) in myย ๐—•๐˜‚๐—ถ๐—น๐—ฑ๐—ถ๐—ป๐—ด ๐—ฎ ๐—ฆ๐—ฒ๐—ฐ๐˜‚๐—ฟ๐—ฒ ๐—”๐—ฐ๐˜๐—ถ๐˜ƒ๐—ฒ ๐——๐—ถ๐—ฟ๐—ฒ๐—ฐ๐˜๐—ผ๐—ฟ๐˜† ๐—ฐ๐—ผ๐˜‚๐—ฟ๐˜€๐—ฒ, which you can find on my website.

๐Ÿ’ฌ Got another item from Security Baselines that broke something in your environment?