18.3.6 Ensure 'WDigest Authentication' is set to 'Disabled'

Information

When WDigest authentication is enabled, Lsass.exe retains a copy of the user's plaintext password in memory, where it can be at risk of theft. If this setting is not configured, WDigest authentication is disabled in Windows 8.1 and in Windows Server 2012 R2; it is enabled by default in earlier versions of Windows and Windows Server.

Solution

To establish the recommended configuration via GP, set the following UI path to Disabled:
Computer Configuration\Policies\Administrative Templates\MS Security Guide\WDigest Authentication (disabling may require KB2871997)
This Group Policy path does not exist by default. An additional Group Policy template (SecGuide.admx/adml) is required

See Also

https://workbench.cisecurity.org/files/1941

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-5(7), CSCv6|16.14

Plugin: Windows

Control ID: ecac555761fe543aa0309a23cffc11ffe8a3770477624b0f9c057fea52df4a52