6

Has anyone else noticed that if you are using a Microsoft account for Windows, after changing your password, the old password can still be used indefinitely on previously authenticated devices? I have one I changed a year ago and it still works to login. The change was done from Windows Settings.

I'm sure there is caching of credentials for login w/o network access, but it doesn't make sense to persist indefinitely. A secondary set of credentials for the local account bound to the Microsoft account may be static even after a password change (so the local account password is never updated). But this seems wrong, security-wise. Users would expect a password change to invalidate the old credentials.

  • Just to be sure, are you certain your Windows login is your Microsoft account password and not your PIN? Windows 10 has been downright obnoxious for a while now about insisting I use a PIN (which can be a password or passphrase) rather than prompting for my MSFT Account Password. The PIN is more secure against certain threats, but overall I'd prefer not to have it... but I can't even remove it; the option is disabled. – CBHacking May 1 at 8:34
  • Yes, account password, not PIN. The answer by Esa suggests that the cached password should have been replaced on the next successful login. This doesn't seem to be the case. Can anyone else confirm this behavior? – dyasta May 1 at 16:23
  • ... It could, however, be that I've only been using my PIN to login, and thus the old cached password is never replaced. But that seems wrong. – dyasta May 1 at 16:26
  • ^ above theory now confirmed, changing password requires users to login using the new password (not just PIN or Hello), else the old password will be accepted indefinitely. – dyasta May 1 at 16:41
2

Microsoft Account

Although it's harded to find official online documentation on this, it seems to work similarly as with the Active Directory domains described below. According to Microsoft Specialist Guide to Microsoft Windows 10 (Exam 70-697, Configuring Windows Devices) by Leon Plesniarski & Byron Wright:

Cached credentials are also used when you selct to sign in with a Microsoft account in non-domain networks. Cached credentials for Microsoft accounts ensure that you can sign in when your computer does not hace access to the Internet.

Top Password Software, Inc. has this blog post that states (for Windows 8):

The cached logon credentials will never expire itself. If you change your Microsoft account password online via https://login.live.com, the cached logon credentials won’t update until you successfully log in to Windows 8 with the new password. After you have successfully logged in to Windows 8 with the new password, you cached logon credentials are updated.

This seems quite reasonable: if the computer completely loses network connectivity (due to hardware failure or configuration error) and there's no local administrator accounts available, you'd completely lose your access to the operating system on password expiration. This also renders you unable to fix the network connection required for checking the new credentials over the Internet.

Despite the cache doesn't expire based on time limits it doesn't mean you can use all your previous passwords, as the new password will replace the previous during the first login with it. This way, a password change invalidates the old credentials; not just at the moment you expected it.

As, starting from Windows 8.1, Microsoft has disabled WDigest and enabled LSA Protection by default, it's less of a problem to store the credentials locally. More information e.g. on Preventing Mimikatz Attacks by Panagiotis Gkatziroulis.

Active Directory Domains

From Cached and Stored Credentials Technical Overview:

Windows logon cached password verifiers

These verifiers are not credentials because they cannot be presented to another computer for authentication, and they can only be used to locally verify a credential. They are stored in the registry on the local computer and provide credentials validation when a domain-joined computer cannot connect to AD DS during a user’s logon. These “cached logons” or more specifically, cached domain account information, can be managed using the security policy setting Interactive logon: Number of previous logons to cache (in case domain controller is not available).

A user can't use the old cached verifiers once

  • the domain-joined computer has been able to contact a DC during a logon for the user, caching the new domain account information
  • more users than specified in the "Number of previous logons to cache" policy have logged in after the user.

However, there seems to be no time based limit for this cache to expire. You could set the number of users to zero, but then no-one would be able to login if there's no DC available. This would probably be ok for most in-office desktops, but not so good with laptops.

| improve this answer | |
  • It could be that since changing my password, I've only been using my PIN to login, and thus the old cached credentials from the last successful password login is never replaced. But that still seems wrong. Just tested this theory, now confirmed. Thanks! – dyasta May 1 at 16:29
  • I only wish I could have found better sources for the Microsoft Account part, but good to hear this was still true. – Esa Jokinen May 1 at 17:05
1

If you change your Microsoft account password, but only ever login to Windows using a PIN or Hello, your old password will be accepted indefinitely, until such a time you actually login to Windows with your new password.

| improve this answer | |
  • 1
    +1. This is actually a useful question, as this could have quite a wide impact. There indeed should be something else besides the actual login that triggers a local update. – Esa Jokinen May 1 at 19:27
  • Also use of the old password to login does not trigger a local update; it will keep working until the new password is actually used to login. – dyasta May 14 at 18:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.