WDigest Use
Whether the WDigest provider is told to keep plaintext passwords in memory.
Use it to tell whether the host was set to hold logged-on passwords in memory in clear text.
- SYSTEM
- Defence Evasion
What It Is
WDigest is Microsoft Digest, a security support provider (SSP), one of the packages Windows offers programs for proving who a user is. It implements the Digest Access protocol, a simple challenge and response sign-in for programs that talk over HTTP or the Simple Authentication Security Layer (SASL). This key, in the SYSTEM hive, holds its settings, and UseLogonCredential tells it whether to keep the signed-in user's credentials in memory. Microsoft began deprecating WDigest in Windows 11 22H2.
What It Proves
UseLogonCredential set to 1 forces plaintext credentials into memory on logon, so passwords on this host should be treated as exposed. The default from Windows 8.1 on is not to hold them.
What It Does Not Prove
It shows configuration, not that credentials were read. From Windows 8.1 on the value is absent by default, so its presence is itself notable.
Where It Lives
WDigest UseLogonCredential lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| Plaintext credential caching is switched on, so passwords for anyone who logs on sit in memory. Set it to 0 and treat those credentials as exposed. |
| WDigest is in its secure state and will not hold plaintext passwords. A later change to 1 is what you are watching for. |
How to Read It
Read UseLogonCredential under Control\SecurityProviders\WDigest in each ControlSet. A missing value or 0 is the secure state, and 1 means plaintext caching is on. To put it right, set it to 0, have affected users log on again, and rotate the exposed credentials.
- When Windows Writes It
- It is written when an administrator or an attacker with admin rights sets the value. Windows does not set it by default on 8.1 and later.
- Which Windows Versions
- Windows 7 and Server 2008 R2 to 11 (default off from 8.1 and Server 2012 R2)
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper
Hunt It
Defender records writes to this value. A change to 1 shows the setting, not that passwords were read, but treat passwords of later logons as exposed.
// WDigest plaintext caching switched onDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what WDigest UseLogonCredential shows.
- Registry Value Set, Sysmon Event 13Not in the RegistryDates when UseLogonCredential was set, and names the process that set it.
Sources
The facts on this page come from these public pages, which say more on each point.
- Microsoft Security Advisory 2871997 (opens in a new tab)
- MITRE ATT&CK T1003.001: OS Credential Dumping: LSASS Memory (opens in a new tab)
- Velociraptor: Windows.Registry.WDigest (opens in a new tab)
- Microsoft Learn: Microsoft Digest SSP (opens in a new tab)
- Microsoft Support: update to improve credentials protection and management (KB 2871997) (opens in a new tab)