In Windows XP, is it possible to disable user credential caching for particular users
Posted
by kdt
on Server Fault
See other posts from Server Fault
or by kdt
Published on 2010-05-21T14:38:40Z
Indexed on
2010/05/21
14:51 UTC
Read the original article
Hit count: 264
I understand that when windows caches user credentials, these can sometimes be used by malicious parties to access other machines once a machine containing cached credentials is compromised, a method known as "pass the hash"[1]. For this reason I would like to get control over what's cached to reduce the risk of cached credentials being used maliciously.
It is possible to prevent all caching by zeroing HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount
, but this is too indiscriminate: laptops users need to be able to login when away from the network. What I would like to do is prevent the caching of credentials of certain users, such as administrators -- is there any way to do that in Windows XP?
© Server Fault or respective owner