13cb0c87-4b9a-4923-9768-87bafab6ef87
When the WDigest Authentication protocol is enabled, plain-text passwords are stored in the Local Security Authority Subsystem Service (LSASS), exposing them to theft. WDigest is disabled by default in Windows Server 2019. This setting ensures this is enforced.
To fix this configure the policy value for
Computer Configuration
|_ Administrative Templates
|_ MS Security Guide
|_ WDigest Authentication (disabling may require KB2871997) to "Disabled".
This policy setting requires the installation of the SecGuide custom templates. "SecGuide.admx" and " SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively. C:\Windows\SYSVOL\domain\Policies\PolicyDefinitions\ folder for domain controllers
Available here: https://www.microsoft.com/en-us/download/details.aspx?id=55319
or at EventSentry GitHub repository here: https://github.com/eventsentry/resources
More information: https://admx.help/?Category=SecurityBaseline&Policy=Microsoft.Policies.PtH::Pol_PtH_WDigestAuthn
STIG: Server:
2022: https://www.stigviewer.com/stig/microsoft_windows_server_2022/2022-08-25/finding/V-254334
2019: https://www.stigviewer.com/stig/microsoft_windows_server_2019/2022-03-01/finding/V-205687 / https://www.stigviewer.com/stig/windows_server_2019/2020-06-15/finding/V-93401
2016: https://www.stigviewer.com/stig/microsoft_windows_server_2016/2021-09-29/finding/V-224915 / https://www.stigviewer.com/stig/windows_server_2016/2020-06-16/finding/V-73497
Desktop:
W11: https://www.stigviewer.com/stig/microsoft_windows_11/2022-06-24/finding/V-253358
W10: https://www.stigviewer.com/stig/microsoft_windows_10/2022-04-08/finding/V-220800 / https://www.stigviewer.com/stig/windows_10/2021-08-18/finding/V-220800