Send your Windows question to Mitch today! | See other Windows tips

A reader recently contacted me concerning a previous tip Troubleshooting Cached Logons where I shared a script that could be used to query your event logs to determine whether your machine is currently logged on using cached credentials. When you try to log onto your domain and your Windows XP computer can't contact a domain controller, your computer uses cached credentials to authenticate. These credentials are cached locally on your machine from a previous successful domain authentication, and are designed to enable you to log onto domain members when domain controllers are unavailable.



The reader told me that he heard from "some security experts" that storing domain credentials locally on client machines like this poses a security vulnerability since anyone who can gain access to your computer can run a password cracker against these stored credentials and extract your domain username and password from them. But how serious a vulnerability is this? To find the answer, I cracked open one of my all-time favorite books, Protect Your Windows Network: From Perimeter To Data by Jesper M. Johansson and Steve Riley.

Steve and Jesper make the following points concerning how Windows implements caching of domain credentials. First, cached credentials are stored in the Security hive and not in LSA Secrets (a much less secure place for storing credentials). Second, cached credentials doesn't actually store your credentials (username and password) or even the NT hash of your credentials. Instead, it stores them as the hash of a hash, salted with your username, and this makes them very difficult to crack using a password cracker. And finally, to crack cached credentials an attacker would need to run a password cracker under the LocalSystem account, in which case they have complete control of your machine anyway so you've got more important things to worry about, right?

If you're still worried however concerning the security of cached credentials, you can do two things to mitigate the risks. First, use Group Policy to force users to use strong passwords as this will make trying to crack cached credentials unfeasible due to the length of time needed to crack them. And second, you can use Group Policy to disable credential caching on machines that don't need it. For example, cached credentials should be disabled on all your servers and probably all your desktop computers also -- only mobile users really need them so they can log onto their laptops when they're away from the office.

ITworld.com

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine