WDigest Authentication
The `UseLogonCredential` DWORD value controls whether WDigest stores credentials in memory.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential
The UseLogonCredential DWORD value controls whether WDigest stores credentials in memory. A value of 0 prevents WDigest from retaining password credentials in memory for subsequent reuse.
This value does not disable the WDigest authentication protocol itself. Applications can still use WDigest, but they might need to request credentials from the user instead of reusing credentials collected during Windows sign-in.
Notes
Security
A value of 0 prevents WDigest from retaining a reusable plaintext representation of the password in the LSASS logon session. This removes a known source from which attackers capable of reading LSASS memory could obtain passwords.
The setting affects only credential storage by WDigest. It does not protect other credentials held by LSASS or prevent exposure of credentials that a user later supplies explicitly to an application or connection.
Possible side effects
Applications and services that use WDigest might prompt for credentials more frequently. In particular, legacy applications can behave differently if they depend on reusing credentials obtained during Windows sign-in.
Notes
On Windows 8.1, Windows Server 2012 R2, and later versions, in-memory caching of WDigest credentials is disabled by default. If the registry value is absent, the default behavior is equivalent to 0.
On Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012, control through UseLogonCredential was introduced by security update 2871997. After that update was installed, the default value on those systems was 1.
Microsoft has deprecated Microsoft Digest, also known as WDigest, starting with Windows 11, version 22H2. Its capabilities are expected to become more limited in future Windows versions before support is eventually removed.
Microsoft documentation
Microsoft Support: Update to improve credentials protection and management
Microsoft Learn: Windows security baseline
Microsoft Learn: Initial Authentication Using Microsoft Digest