4 ms·
> Keeping your password in memory like that is pretty sketchy IMO. Every Windows version since "... for Workgroups" keeps the passwords of every logged-in user
by formerly_proven 2y ago
> Keeping your password in memory like that is pretty sketchy IMO.
Every Windows version since "... for Workgroups" keeps the passwords of every logged-in user in memory as plaintext. This fact is widely exploited for privilege escalation and lateral movement in Windows environments.
- shortsunblack 2y agoLocal security authority protection changes this.
- formerly_proven 2y agoDo I understand it correctly that LSA Protection leverages VBS/VSM such that the "actual" Windows instance is punted into a VM while LSASS and friends run in a separate VM, with communication between the two controlled by a specialized version of Hyper-V?
- p_ing 2y agoSee https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection#lsa-and-credential-guard https://learn.microsoft.com/en-us/windows-server/security/cr...
- dist-epoch 2y agoWhich is why recently Microsoft has been pushing very hard to replace the account login password with a TPM managed PIN. This way the (Microsoft) account password is rarely needed and never stored in memory.