I want to know under which case would Mimikatz still run despite disabling WDigest?
Whether wdigest is set to 1 or 0, mimikatz still worked. (tested on Windows 7, 8, 2012)
Is there a better way to block it specifically on the OS level?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
WDigest isn't a setting which disables Mimikatz, it's a form of encryption supported by Windows, which when enabled, allows Mimikatz to very easily dump plaintext passwords.
Disabling WDigest removes that one type of credential from memory, but a user with Administrator-level privileges can still dump other forms of interesting credentials. Mimikatz has plenty of additional capabilities which don't rely on WDigest!
So what you're really asking looks like a meta-question: How do I stop unwanted software running on my computers?
And in short, the answer is to either enable security features available to you:
Or potentially require use of Windows 10 S Mode or a device which can only run Store-derived software (and lock the selection down).
Preventing any kind of unwanted software (like malware) requires a holistic approach.