Windows WDigest Authentication

🔒 Secure Bits 💡
𝗣𝗹𝗮𝗶𝗻𝘁𝗲𝘅𝘁 𝗣𝗮𝘀𝘀𝘄𝗼𝗿𝗱𝘀 𝗶𝗻 𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝟭𝟭? 𝗦𝘁𝗶𝗹𝗹 𝗽𝗼𝘀𝘀𝗶𝗯𝗹𝗲.

Modern Windows versions like Windows 11 and Windows Server 2025 are 𝗳𝗮𝗿 𝗺𝗼𝗿𝗲 𝘀𝗲𝗰𝘂𝗿𝗲 𝗯𝘆 𝗱𝗲𝗳𝗮𝘂𝗹𝘁. But 𝗹𝗲𝗴𝗮𝗰𝘆 𝗰𝗼𝗺𝗽𝗼𝗻𝗲𝗻𝘁𝘀 𝗰𝗮𝗻 𝘀𝘁𝗶𝗹𝗹 𝗶𝗻𝘁𝗿𝗼𝗱𝘂𝗰𝗲 𝘀𝘂𝗿𝗽𝗿𝗶𝘀𝗶𝗻𝗴 𝗿𝗶𝘀𝗸𝘀 — if you’re not careful.

𝗢𝗻𝗲 𝗲𝘅𝗮𝗺𝗽𝗹𝗲: 𝗪𝗗𝗶𝗴𝗲𝘀𝘁 𝗮𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻.
Disabled by default for years — but with one registry tweak, you can re-enable it, and Windows will start caching plaintext credentials again.

🛠 𝗥𝗲𝗴𝗶𝘀𝘁𝗿𝘆 𝗽𝗮𝘁𝗵:
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential=1
𝗡𝗼 𝗿𝗲𝗯𝗼𝗼𝘁 𝗻𝗲𝗲𝗱𝗲𝗱 — just a logon, and the password is in memory.

👀 𝗪𝗵𝘆 𝘄𝗼𝘂𝗹𝗱 𝘁𝗵𝗶𝘀 𝗺𝗮𝘁𝘁𝗲𝗿?
For attackers, plaintext creds open more doors than hashes — and this is a known technique used to bypass otherwise modern protections.

⚠️ 𝗟𝗦𝗔𝗦𝗦 𝗽𝗿𝗼𝘁𝗲𝗰𝘁𝗶𝗼𝗻 𝗶𝘀 𝗴𝗼𝗼𝗱, 𝗯𝘂𝘁 𝗻𝗼𝘁 𝗽𝗲𝗿𝗳𝗲𝗰𝘁:
✅ Windows 11 protects LSASS by default
❗ But Credential Guard requires Enterprise edition — and 𝗺𝗮𝗻𝘆 𝗼𝗿𝗴𝘀 𝘀𝘁𝗶𝗹𝗹 𝗿𝘂𝗻 𝗣𝗿𝗼
✅ Protected Users group is free and effective — and often underused. It blocks several forms of credential caching, including WDigest.

🔐 If you’re not using Protected Users for your privileged accounts — you’re leaving them exposed.

I am not even mentioning 𝘁𝗵𝗲 𝗺𝗲𝗺𝗼𝗿𝘆 𝗼𝗳 𝗠𝗦𝗧𝗦𝗖 𝗽𝗿𝗼𝗰𝗲𝘀𝘀, which I discuss in another post….

💬 How are you defending against credential theft in your org?