Credentials on a Running Machine
What LSASS holds for single sign-on, what is saved to disk, and what a logon leaves.
Why It Matters
Whoever gains admin rights on a machine can take what it holds for everyone signed in to it. How an administrator connects decides whether their reusable credentials are part of that.
What Happens
For single sign-on, the Local Security Authority process (lsass.exe, often called LSASS) keeps credentials in memory for users whose sessions are still open. It can hold the NT hash, Kerberos tickets and, in some cases, a reversibly encrypted password or the old LM hash. They stay until the session ends or the machine restarts, and a Remote Desktop session that was only disconnected has not ended.
Some secrets are saved to disk in the SECURITY hive. LSA secrets hold the computer account's own password and the passwords of services, scheduled tasks and IIS application pools set to run as an account. Cached domain logons, ten by default, hold verifiers that let a user sign in when no domain controller answers.
A cached verifier cannot be presented to another machine, only guessed against offline, while an LSA secret is the password itself. The computer account's secret gives that machine's key, the key a silver ticket to its services is forged with.
How an administrator connects decides what stays behind. Console, RunAs, Remote Desktop, scheduled task and service logons leave reusable credentials on the target. Network logons, such as a share, a remote management console or PowerShell remoting, do not.
Credential Guard adds an isolated LSA process, LsaIso.exe, which keeps NT hashes and TGTs in virtualisation-based security out of reach of admin code. LSA protection instead runs lsass.exe as a protected process, and WinInit event 12 in the System log confirms it started that way.
What Each Logon Type Leaves Behind
The way a session starts decides whether reusable credentials stay on the machine afterwards. Read the Logon Type in the session's event 4624 in the Security log, then find it here to see what someone with admin rights could take from that machine.
| Logon Type | Typical Use | Reusable Credentials Left |
|---|---|---|
| Interactive (2) | Console sign-in, RunAs | Yes |
| Network (3) | Shares, remote management consoles, PowerShell remoting | No, though Kerberos tickets are kept where delegation is allowed |
| Batch (4) | Scheduled tasks | Yes, and the password is saved as an LSA secret |
| Service (5) | Services | Yes, and the password is saved as an LSA secret |
| NetworkCleartext (8) | PowerShell with CredSSP, IIS Basic authentication | Yes |
| NewCredentials (9) | RunAs for network use only | Yes |
| RemoteInteractive (10) | Remote Desktop | Yes, unless Restricted Admin mode or Remote Credential Guard is used |
Remote Desktop and the Administrator's Credentials
Remote Desktop normally sends the administrator's credentials to the server, where they stay in memory. Restricted Admin mode and Remote Credential Guard change that, and this table shows what each one sends and how the session reaches other machines.
| Connection | Credentials Sent to the Server | The Session Reaches Other Machines As |
|---|---|---|
| Remote Desktop | Yes, and they stay usable after a disconnect | The administrator |
| Restricted Admin mode | No | The server's own computer account |
| Remote Credential Guard | No, because Kerberos requests go back to the administrator's machine | The administrator, only while the session is connected |
What Is Logged
Each event below names the log it is written to, the machine that writes it and the audit setting that switches it on, then what to read in it for this page.
| Event and Log | Written On | Switch It On | What It Tells You |
|---|---|---|---|
| 4624 An account was successfully logged on (opens in a new tab) Security log | The computer that was logged on to | Audit Logon | Logon Type says what the session may have left behind. For Remote Desktop, Restricted Admin Mode says whether the credentials stayed off the server.Reading Logon Events explains how to read it. |
| 4779 A session was disconnected from a Window Station (opens in a new tab) Security log | The computer the session is on | Audit Other Logon/Logoff Events | A Remote Desktop session was disconnected. Unless a logoff follows, its credentials are still in memory.Reading Logon Events explains how to read it. |
| 3033, 3063, 3065 and 3066 A code integrity check determines that a process, usually LSASS.exe, attempts to load a driver that doesn't meet the Microsoft signing level requirements (opens in a new tab) Microsoft-Windows-CodeIntegrity/Operational log | Any Windows computer that runs LSA protection, domain controllers included | LSA protection on (3033 and 3063 record a refused load) or in audit mode (3065 and 3066) | LSA protection refused (3033, 3063), or in audit mode would refuse (3065, 3066), a module loading into LSASS. |
Check It on a Machine
These Windows Registry keys hold the settings this page names. Open one to see where it lives and how to read it on a machine.
Attacks That Hook in Here
These attacks work through what this page describes. Each card says what the attack is and, where it uses one of these steps, what it does there.
- LSASS Memory Theft
Reads the hashes and tickets that sign-ins left on a machine out of LSASS memory.
- SAM, LSA Secrets and Cached Logons
Takes local hashes, stored passwords and cached domain logons from a machine's hives.
- Pass-the-Hash
Signs in over NTLM with a stolen NT hash, never needing the password.
- Pass-the-Ticket
Replays a Kerberos ticket copied from one machine's memory on another.
- Skeleton Key
Patches LSASS on a DC so one master password signs in as any account.
- LAPS and gMSA Password Reads
Reads a managed local-admin or service-account password straight from the directory.
Sources
- Microsoft Learn: Credentials Processes in Windows Authentication (opens in a new tab)
- Microsoft Learn: Administrative Tools and Logon Types (opens in a new tab)
- Microsoft Learn: Remote Credential Guard (opens in a new tab)
- Microsoft Learn: How Credential Guard Works (opens in a new tab)
- Microsoft Learn: Configure Added LSA Protection (opens in a new tab)
- Microsoft Learn: Interactive Logon: Number of Previous Logons to Cache (opens in a new tab)
- MITRE ATT&CK T1003.004: OS Credential Dumping: LSA Secrets (opens in a new tab)
- MITRE ATT&CK T1003.005: OS Credential Dumping: Cached Domain Credentials (opens in a new tab)