Credentials: WDigest Authentication must be disabled

13cb0c87-4b9a-4923-9768-87bafab6ef87

When the WDigest Authentication protocol is enabled, plain-text passwords are stored in the Local Security Authority Subsystem Service (LSASS), exposing them to theft. WDigest is disabled by default in Windows Server 2019. This setting ensures this is enforced.

Remediation

To fix this configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "WDigest Authentication (disabling may require KB2871997)" to "Disabled".

https://admx.help/?Category=SecurityBaseline&Policy=Microsoft.Policies.PtH::Pol_PtH_WDigestAuthn

STIG: Server 2019: https://www.stigviewer.com/stig/windows_server_2019/2020-06-15/finding/V-93401
Server 2016: https://www.stigviewer.com/stig/microsoft_windows_server_2016/2021-09-29/finding/V-224915
Desktop: https://www.stigviewer.com/stig/windows_10/2021-08-18/finding/V-220800