Disable WDigest to Prevent Plaintext Credential Caching in LSASS Memory
Disabling WDigest stops Windows from storing your users' passwords in plaintext in server memory, where tools like Mimikatz can read them in seconds.
✓ Tested on WS2022·Rollback included
An attacker who gains any foothold on your server — even a low-privileged service account — can run Mimikatz in two commands and read the plaintext passwords of every user currently logged on, including Domain Admins. This is one of the most common techniques used in ransomware attacks and internal penetration tests.
WDigest is a legacy authentication protocol from the early 2000s. Windows Server keeps WDigest enabled by default for backwards compatibility. When enabled, Windows stores a copy of every logged-on user's password in plaintext in LSASS memory. This means any attacker who reaches LSASS — and Mimikatz makes this trivially easy — can read every active user's password in cleartext.
Probably yes if any of these apply:
Affected OS versions
A penetration tester with access to a single compromised service account runs Mimikatz on a member server during a client engagement. Within 30 seconds they have the plaintext password of a Domain Administrator who is logged on. They use it to access every server in the domain. This finding appears in the majority of internal penetration test reports against Windows environments.
Fix-Windows-Server-Wdigest-Authentication-Disabled-Hardening.ps1
3.8 KBRollback-Windows-Server-Wdigest-Authentication-Disabled-Hardening.ps1
2.4 KBSHA-256: 7fa0de1bc6aeea6d512eedcad662238ec94cb357516adf40a9dd5d6d683aca3f
Run interactively
.\Fix-Windows-Server-Wdigest-Authentication-Disabled-Hardening.ps1
Run silently (SCCM / Intune)
.\Fix-Windows-Server-Wdigest-Authentication-Disabled-Hardening.ps1 -Silent -OutputPath C:\Logs
Manual fallback (no script)
⏱ 10 minutesCheck Current Status
$path = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest'
$val = Get-ItemProperty -Path $path -Name UseLogonCredential -ErrorAction SilentlyContinue
if ($val.UseLogonCredential -eq 0) {
Write-Host 'SECURE: WDigest is disabled' -ForegroundColor Green
} else {
Write-Host 'VULNERABLE: WDigest is enabled or not configured' -ForegroundColor Red
}
Disable WDigest
$path = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest'
Set-ItemProperty -Path $path -Name UseLogonCredential -Value 0 -Type DWord
Verification
(Get-ItemProperty -Path $path).UseLogonCredential
# Must return 0
Notes
Verify after patching
Confirm the patched version is running:
# Expect: WDigest disabled (UseLogonCredential = 0) or later
Script details · parameters · exit codes↓
Tested On
—
Reboot
Logon RequiredSCCM
✓ Compatible
Est. Time
10 minutes
Parameters
How to Run
Interactive — see output in console
.\Fix-Windows-Server-Wdigest-Authentication-Disabled-Hardening.ps1
Silent mode — for SCCM / automation
.\Fix-Windows-Server-Wdigest-Authentication-Disabled-Hardening.ps1 -Silent
With custom log path
.\Fix-Windows-Server-Wdigest-Authentication-Disabled-Hardening.ps1 -OutputPath "C:\Logs"
Exit Codes
| Code | Meaning |
|---|---|
| 0 | Success — fix applied or already patched |
| 1 | Failure — check log file |
| 3010 | Success — reboot required to complete |
Fix, idempotency, and rollback verified on
⚠ Rollback available. If this fix causes issues, run Rollback-Windows-Server-Wdigest-Authentication-Disabled-Hardening.ps1 to restore the previous state.