Unlocking Windows RDP: How Revoked Passwords Can Still Grant Access—And Why Microsoft Approves

When using Remote Desktop Protocol (RDP) on a Windows machine signed in with a Microsoft or Azure account, a unique issue arises. Even after changing your account password, the old password can still grant access indefinitely. This occurs because RDP can verify credentials against stored local data instead of checking online each time.

Security expert Wade has observed that even multiple old passwords may still work while the current one might not. This means if a Microsoft or Azure account is compromised—perhaps due to a public password leak—an attacker can still log in through RDP without triggering any security measures. In fact, changing your password only prevents access to your online account. The cached old password stays valid for remote access.

This situation essentially creates an unnoticed backdoor into your system. Wade’s report articulates this concern, noting that Windows will continue to trust any cached passwords, even if the attacker never gained access to the machine itself.

Will Dormann, a senior vulnerability analyst, echoed these concerns. He pointed out the flaws in this system: “If I’m managing a system, I expect that changing a password would invalidate old access rights. But that’s not what happens here.”

The core issue lies in how credential caching works. When you first use your Microsoft or Azure account for RDP, your credentials are validated online and then stored securely on your local hard drive. After this initial login, the system only checks the local data, skipping online verification. As a result, even after a password change, the old password still offers a way in via RDP.

Recent research indicates that instances of compromised accounts are rising. According to a 2021 report from Microsoft, over 1 in 3 organizations experienced credential theft. With more systems relying on cloud accounts for access, this vulnerability could lead to significant data breaches if not addressed.

In light of this, cybersecurity experts recommend regular audits of RDP access and thorough password management strategies. Always ensure that your system is up-to-date, and consider additional layers of security, like multi-factor authentication.

Understanding how credential caching works is crucial in managing your security effectively in today’s technology landscape.

Source link