3 ms·

A domain admin can access the user's long term kerberos encryption keys and generate arbitrary key tabs for that user. If you have domain admin, you can access

• zahllos 7y ago
  Of course. Hence it isn't really a flaw if you need domain admin to gain access. It's a vulnerability or major fault if an ordinary user can get access, or worse an unauthenticated user / someone with a specially crafted network packet. Obviously domain admin accounts need to be suitably protected and you hint at this in your comment (ESAE) but that's another matter. This bug is another such example - you have to decide to enable this and ask Windows to store your password to log you in, and that's exactly what happens, including exposure of any secrets protected via DPAPI / bound to your account. It's a convenience feature, working as intended. Perhaps the impact should be made clearer, but there are even legitimate reasons for this sort of functionality, such as self-service kiosks that are often built with windows images.