Windows 11 And Server 2025 Will Start Caching Plaintext Credentials By Enabling WDigest Authentication

WDigest Authentication in Windows 11 and Windows Server 2025

Recent analysis has identified a potential vulnerability in Windows 11 and Windows Server 2025 related to legacy configurations. The feature in question, WDigest authentication, when enabled, allows the caching of plaintext passwords in memory, which could expose users to credential theft.

WDigest authentication was disabled by default starting with Windows 10 version 1703. Originally, it was designed to store hashed credentials to maintain compatibility with older applications. However, a registry modification can reactivate it, allowing Windows to store unencrypted passwords during logon sessions.

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential

Setting this key to 1 activates the feature immediately upon the next user logon without requiring a system reboot. This can result in sensitive credentials being stored in process memory, making them susceptible to extraction by malware or attackers with local access.

Plaintext credentials are highly valuable to attackers as they facilitate quicker lateral movement across networks. Tools such as Mimikatz have previously exploited WDigest for this purpose. Despite enhancements like the protection of the Local Security Authority Subsystem Service (LSASS) in Windows 11, vulnerabilities persist when WDigest is reactivated, undermining these security measures by storing passwords in plaintext.

Organizations using Windows 11 Pro editions may overlook this risk. While advanced security features like Credential Guard are available in Enterprise and Education versions, Pro users remain vulnerable if legacy applications necessitate WDigest compatibility.

To mitigate this threat, organizations can employ built-in tools such as the Protected Users group in Active Directory . This group blocks WDigest caching and other weak authentication methods for high-privilege accounts. However, adoption is low, and security audits often reveal privileged users outside this group.

Scanning for the WDigest registry key. Auditing group memberships for high-privilege accounts. Enabling multi-factor authentication. Monitoring for unusual memory access patterns.

While Microsoft continues to phase out legacy authentication methods, user vigilance is crucial to maintaining security. Correct configuration is essential to prevent potential vulnerabilities from being exploited.

Based on reporting by Cyber Security News.