In theory perhaps: but by the description given in this article the keys are not permanent, and that means you'd need to wait for an automatic reboot, and cut t

In theory perhaps: but by the description given in this article the keys are not permanent, and that means you'd need to wait for an automatic reboot, and cut the power while that's occurring, and you need to do that right on the very first try, because if the system fails to store the key for any reason, it's not retrievable without the user logging in (and if you could do that, this whole saga wouldn't have been necessary). The demo appears to require admin access anyhow. I suppose if you steal a laptop that's on but locked, and doesn't use FDE, and then open it up and hook it up to the power, wait for patch tuesday, and pull out the battery/cut the power at just the right moment, this is likely reproducibly exploitable without access. It's a risk, but a fairly far-fetched one. If you have attackers that determined and skilled, use FDE... and pray, because if you've got that kind of time, patience and physical access, there are likely over avenues to exploit. Admittedly, the features gained for this crack in the security sound pretty limited - after auto-update lock screen apps that depend on DPAPI still display? Yawn. Edit: https://vztekoverflow.com/2018/07/31/tbal-dpapi-backdoor/ https://vztekoverflow.com/2018/07/31/tbal-dpapi-backdoor/ this description is slightly different, and clearly states that the TBAL credentials-saving hack gets used every shutdown, which is much easier to trigger. Given the pointlessness of this feature in the first place, I'm turning if off.