Windows

508 readers

4 users here now

For all things Windows.

founded 4 years ago

MODERATORS

QuentinCallaghan@sopuli.xyz

Windows RDP lets you log in using revoked passwords. Microsoft is OK with that. (arstechnica.com)

submitted 3 days ago by neme@lemm.ee to c/windows@sopuli.xyz

7 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] Nougat@fedia.io 7 points 3 days ago (1 children)

Cached credentials have been a thing for a long time, and that’s saved my bacon more than once.

The trouble here is that RDP will check the cached credentials first, even if the machine is online and able to check the authoritative creds. And then it doesn’t erase the obsolete cached creds. This is apparently only for Microsoft or Azure accounts, but ffs they’ve been pushing individuals and businesses that way for so long.

This most definitely is a security issue.

[–] phoenixz@lemmy.ca 2 points 3 days ago

This most definitely is a security issue

Meaning that Microsoft won't fix it