Windows Credential Protections

This skill helps you assess and understand Windows credential protection mechanisms. Use it to audit security configurations, troubleshoot credential dumping failures, or harden Windows systems against credential theft.

Quick Reference

HKLM\...\WDigest\UseLogonCredential

HKLM\...\LSA\RunAsPPL

HKLM\...\LSA\LsaCfgFlags

HKLM\...\WINLOGON\CachedLogonsCount

WDigest Protection

WDigest stores passwords in plain text in LSASS memory when enabled. This is a critical security risk.

Check WDigest Status

reg query HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential

• Value = 1: WDigest is ENABLED (plain text passwords in memory)
• Value = 0 or missing: WDigest is DISABLED (secure)

Disable WDigest (Recommended)

reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 0 /f
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v Negotiate /t REG_DWORD /d 0 /f

Mimikatz Extraction

If WDigest is enabled, credentials can be extracted with:

sekurlsa::wdigest

LSA Protection (PP & PPL)

Protected Process (PP) and Protected Process Light (PPL) prevent unauthorized access to LSASS.

Check LSA PPL Status

reg query HKLM\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL

• Value = 1: LSASS runs as PPL (Protected Process Light)
• Value = 0: LSASS is unprotected

Understanding PPL Protection Levels

PPL Bypass Options

1. Signed kernel driver (e.g., Mimikatz + mimidrv.sys) - removes protection flag
2. BYOVD (Bring Your Own Vulnerable Driver) - PPLKiller, gdrv-loader, kdmapper
3. Handle duplication - steal LSASS handle from AV process (

   pypykatz live lsa --method handledup

   )
4. Privileged process abuse - load code into signed process (PPLdump)

Create PPL Process (API)

Windows provides documented API to request PPL for child processes:

// Requires properly signed image for the requested signer class
STARTUPINFOEXW si = {0};
PROCESS_INFORMATION pi = {0};
// ... InitializeProcThreadAttributeList ...
DWORD level = PROTECTION_LEVEL_LSA_LIGHT;
UpdateProcThreadAttribute(si.lpAttributeList, 0,
    PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL, &level, sizeof(level), NULL, NULL);
CreateProcessW(..., EXTENDED_STARTUPINFO_PRESENT, ...);

Note: The child image must be signed for the requested signer class, or creation fails with

ERROR_INVALID_IMAGE_HASH (577)

Credential Guard

Credential Guard uses Virtualization Based Security (VBS) to isolate credentials in a secure memory space.

Check Credential Guard Status

reg query HKLM\System\CurrentControlSet\Control\LSA /v LsaCfgFlags

• Value = 1: Enabled with UEFI lock (most secure)
• Value = 2: Enabled without UEFI lock
• Value = 0: Disabled (default)

Key Facts

• Available only on Windows 10 Enterprise/Education and Windows 11 Enterprise/Education 22H2+
• Requires virtualization support in BIOS/UEFI
• Isolates LSA in a Virtual Secure Mode (VSM) trustlet
• Prevents pass-the-hash attacks
• Can be bypassed via custom SSP injection

RDP RestrictedAdmin Mode

Restricted Admin mode prevents credential storage on remote RDP targets.

Usage

mstsc.exe /RestrictedAdmin

Behavior

• Credentials are NOT stored on the remote machine
• Network resource access uses machine identity, not user credentials
• Available on Windows 8.1+ and Server 2012 R2+

Cached Credentials

Windows caches the last 10 domain logins for offline access.

Check Cached Logons Count

reg query "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON" /v CachedLogonsCount

Default Settings

• Default: 10 cached logins
• Location:

  HKLM\SECURITY\Cache

• Access: SYSTEM only

Mimikatz Extraction

lsadump::cache

Protected Users Group

Membership in the Protected Users AD group provides enhanced credential protection.

Protections Applied

Protected Groups by Server Version

Troubleshooting Mimikatz Failures

Error 0x00000005 (Access Denied)

Cause: LSASS is running as PPL

Solution: Use one of the PPL bypass methods above

WDigest Returns Nothing

Cause: WDigest is disabled (UseLogonCredential = 0)

Solution: Enable WDigest (not recommended for security) or use other extraction methods

Credential Guard Blocks Extraction

Cause: LsaCfgFlags = 1 or 2

Solution: Requires VSM bypass or custom SSP injection

Security Recommendations

1. Disable WDigest on all systems (UseLogonCredential = 0)
2. Enable LSA PPL (RunAsPPL = 1) on Windows 8.1+
3. Enable Credential Guard on Enterprise systems where possible
4. Use RestrictedAdmin mode for RDP connections
5. Limit CachedLogonsCount to minimum necessary
6. Add privileged accounts to Protected Users group

References

• LSASS RunAsPPL - itm4n
• Credential Guard - Microsoft Docs
• Protected Users Group - Microsoft Docs
• CreateProcessAsPPL - GitHub
• Restricted Admin Mode - Blog