Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
When I enter my domain admin user credentials into the RDP Window, does the Client also save my password hash?
Example:
Windows 10 Client -> Remote Desktop -> Enter Domain Admin User and Password -> Connect to Domain Controller or other Critical Service Host.
Is the password hash being saved on my Windows 10 Client?
No, it's not.
The client prompts for the password using a thing called Cred UI, which passes it off the to Windows security stack called LSA. LSA converts the password into a Kerberos key and attempts to authenticate to a Domain Controller, getting a ticket to the remote machine, and then sending the ticket to the remote machine.
If Kerberos fails it falls back to NTLM and generates an NTLM HMAC challenge from the password, sending it off to the target computer.
If the remote machine accepts either the ticket or the NTLM challenge, both the client and target machine do a key agreement (both sides figure out that they can make up a cryptographic key somehow without showing all their cards to the other side) and the client encrypts the user's password using that agreed upon key. The target receives the password and decrypts it and then logs the user on.
Technically the client process has given up the password once it left CredUI and it should only be present in the LSA process from then on. The password is then cleared from LSA once it's been sent in the last leg.
All of this relies on a well known protocol called CredSSP.
Source: https://syfuhs.net/how-authentication-works-when-you-use-remote-desktop
