13cb0c87-4b9a-4923-9768-87bafab6ef87
When the WDigest Authentication protocol is enabled, plain-text passwords are stored in the Local Security Authority Subsystem Service (LSASS), exposing them to theft. WDigest is disabled by default in Windows Server 2019. This setting ensures this is enforced.
To fix this configure the policy value for
Computer Configuration
|_ Administrative Templates
|_ MS Security Guide
|_ WDigest Authentication (disabling may require KB2871997) to "Disabled".
More information: https://admx.help/?Category=SecurityBaseline&Policy=Microsoft.Policies.PtH::Pol_PtH_WDigestAuthn
STIG: Server:
2022: https://www.stigviewer.com/stig/microsoft_windows_server_2022/2022-08-25/finding/V-254334
2019: https://www.stigviewer.com/stig/microsoft_windows_server_2019/2022-03-01/finding/V-205687 / https://www.stigviewer.com/stig/windows_server_2019/2020-06-15/finding/V-93401
2016: https://www.stigviewer.com/stig/microsoft_windows_server_2016/2021-09-29/finding/V-224915 / https://www.stigviewer.com/stig/windows_server_2016/2020-06-16/finding/V-73497
Desktop:
W11: https://www.stigviewer.com/stig/microsoft_windows_11/2022-06-24/finding/V-253358
W10: https://www.stigviewer.com/stig/microsoft_windows_10/2022-04-08/finding/V-220800 / https://www.stigviewer.com/stig/windows_10/2021-08-18/finding/V-220800