Ensure 'Network access: Do not allow storage of passwords and credentials for network authentication' is set to 'Enabled'

MediumLevel 2Automatedwindows

Description

This policy setting determines whether Credential Manager (formerly called Stored User Names and Passwords) saves passwords or credentials for later use when it gains domain authentication. The recommended state for this setting is: Enabled. Note: Changes to this setting will not take effect until Windows is restarted.

How it is checked

Audit method: Windows registry

registry

$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa' -Name 'DisableDomainCreds' -ErrorAction SilentlyContinue).'DisableDomainCreds'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'DisableDomainCreds=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

Expected output: compliant

How it is fixed

Fix method: Shell command

shell

if (-not (Test-Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa')) { New-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa' -Force | Out-Null }; New-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa' -Name 'DisableDomainCreds' -Value 1 -PropertyType DWord -Force | Out-Null

Properties

Operating systems: windows-server-2025-dc, windows-server-2025-ms
Tags: cis-convertedregistrywindows
Reference: CIS Microsoft Windows Server 2025 Benchmark v2.1.0 - 2.3.10.4

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target windows --level 2