18

If I can change my password with cmd net user example * without needing to confirm my old password, why, when I change my password in the usual way (via settings or control panel), do I need to confirm my old password? If the point of confirming a password is to prevent somebody who finds the PC open from signing in, this circumvents it!

3
  • 5
    Linux does the same. if I run passwd as normal user, I have to provide my password. But as root, it does not ask me for the password. If I already have admin rights, asking for the password again does nothing to really protect the system.
    – ThoriumBR
    Jul 15 '20 at 19:10
  • Isn't half the point there that "cmd net user example *" sits well below Windows? Jul 16 '20 at 20:22
  • 1
    Are you asking about confirming the old password (to know if the original user is making the change) or confirming the new password (by entering it twice)? Jul 17 '20 at 4:58
34

In addition to what nobody said there's a more practical, but mostly internal, requirement here. Changing a local password in Windows without knowing the original password is called a reset. Resets cause DPAPI keys to be invalidated (because they're protected by a primary secret based on the user password). Once the reset happens those original keys are dead and cannot be decrypted because the new password doesn't match the old password.

Changing a user password requires knowledge of the original password so those DPAPI keys can be rotated safely.

Resets are, from an administrative point of view, a worst case solution for this reason. This is actually why you get the "irreversible loss" warning from lusrmgr.msc, and to do so requires local admin privileges.

irreversible loss warning from Windows

5
  • When a user is logged in, doesn't the OS already have access to the DPAPI keys? Why would it need the password again for changing the key?
    – nobody
    Jul 16 '20 at 10:54
  • 2
    @nobody If the OS is handling things properly and in a secure manner, it should not have access to those keys unless they're actually being used. Keys should not be readable in memory unless they're in use, period. This is not always the case on Windows (I'm pretty sure you can have it cache the keys on login so it doesn't prompt for passwords on first usage), but on a properly secured system it should be. Jul 16 '20 at 15:04
  • To be more precise: there's just no guarantee the password is known at that exact moment. Maybe it is, maybe it isn't. Change could theoretically happen outside the users logged on session, though rare.
    – Steve
    Jul 16 '20 at 15:10
  • @AustinHemmelgarn IIRC In Windows, any program running under any user account can ask DPAPI to encrypt/decrypt data when that user is logged on. The user is not prompted for the password again (you can try it yourself). This means the API can access the keys and so it should be able to change them without asking for the password again.
    – nobody
    Jul 16 '20 at 15:24
  • 4
    DPAPI is a lot more complicated than that. There are generations of keys. Just because the current set is decrypted and available in memory doesn't mean the rest are. You need to guarantee all keys can be decrypted, which requires the current password.
    – Steve
    Jul 16 '20 at 16:14
13

Changing the password from command line requires an elevated command prompt (i.e. administrative privileges). Normal users cannot do this. This makes sense since the admin should be able to change the password of any user.

If, however, you have left your computer logged in as an admin user then having your password reset by the intruder would be the least of your worries, since, the intruder could potentially install a complete backdoor on your system without your knowledge.

To reduce the risk of such accidents occurring, its a good idea to use a non-admin account for normal usage and only use accounts with local admin privileges for things like installing new programs or modifying settings.

4
  • 2
    you might want to add a note about not making the user 'local admin' :)
    – schroeder
    Jul 15 '20 at 18:27
  • @schroeder Which 'user' do you mean?
    – nobody
    Jul 15 '20 at 18:28
  • the logged in user - else the OP's situation still applies, yes?
    – schroeder
    Jul 15 '20 at 18:29
  • The question still applies (in fact it is strengthened), If admin is so powerful, why on earth does windows require you still to enter you password in order to change it (however, @Steve's answer does makes sense according to this)
    – Stalemate
    Jul 15 '20 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.