Enable WDigest don't work on windows 11

Question

Enable WDigest don't work on windows 11

oliver queen 0

Microsoft Support Team,

I need assistance enabling WDigest and extracting cleartext passwords from the LSASS process as part of a penetration testing study exercise. Despite following numerous online guides and configuration steps, I have been unable to achieve the desired result.

Lab Setup:

Domain Controller: Windows Server 2025 Standard running in a VirtualBox VM on an Ubuntu PC.
Client Machine: Windows 11 Pro (elevated using Microsoft test keys) running in a VMware VM on an M-series Mac (ARM64).
Domain Name: EREZ.ILRD
Local Administrator Account: Oliver
Domain User Account: SecretUser

Steps Taken to Enable WDigest and Disable Protections:

Disabled all settings under "Virus & threat protection" and "Core isolation" in Windows Security.

Modified relevant registry keys as an administrator (Oliver account): batch

   reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f

Used bcdedit commands to configure boot settings.

   mountvol X: /s
   copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y
   bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader
   bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "\EFI\Microsoft\Boot\SecConfig.efi"
   bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215}
   bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO
   bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X:
   mountvol X: /d

Verified that Secure Boot is disabled and that Virtualization-Based Security is not enabled in msinfo32.
Confirmed the following Group Policy setting: Computer Configuration > Administrative Templates > System > Device Guard > "Turn On Virtualization Based Security" is set to Disabled.
Removed the Trusted Platform Module (TPM) from the VM settings.
Restarted the VM and had both Oliver and SecretUser log in after each change.

Dumping Attempt: Using impacket version 0.13.0 from the Mac host, I ran: secretsdump.py oliver:122345@10.10.1.213

Partial Output (Relevant Sections Captured): The output successfully dumped hashes but no clear-text passwords were retrieved, as shown below:

text

[*] Target system bootKey: 0xf95d1eeb66bbc55b386dbe09de191710

A friend attempting the same process on an x64 PC using Mimikatz reports identical results, with the sekurlsa::wdigest command showing (null) for passwords.

Questions:

Why are cleartext passwords not being stored in LSASS despite UseLogonCredential being set to 1 and all known protections disabled?

What is the correct process to fully enable WDigest and extract cleartext passwords from LSASS on Windows 11, version 25H2?

I look forward to your guidance.

SIMba 0 Reputation points

2026-05-06T12:13:07.06+00:00

Had the same issue, not sure if cleartext dtill exits

1 answer

Your answer

SIMba 0 Reputation points

2026-05-06T12:13:07.06+00:00

Had the same issue, not sure if cleartext dtill exits

Answer 1

Cleartext passwords are not being stored in LSASS on modern Windows by design, even when UseLogonCredential is set to 1, because WDigest credential caching is disabled by default starting with Windows 8.1 / Windows Server 2012 R2 and later, and the platform has progressively deprecated and restricted Microsoft Digest (wDigest) functionality.

From the security advisory and baseline guidance:

UseLogonCredential is the registry value under: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\WDigest
UseLogonCredential = 1 means: WDigest will store credentials in memory.
UseLogonCredential = 0 means: WDigest will not store credentials in memory.
On Windows 8.1, Windows Server 2012 R2 and later versions, the default is that WDigest credential caching in memory is disabled when the registry value is not present; the security baseline explicitly recommends keeping this disabled.

However, in current Windows versions (including Windows 11), Microsoft Digest (wDigest) is being deprecated and its capabilities are being reduced:

Microsoft Digest (wDigest) is explicitly marked as deprecated starting in Windows 11 22H2.
Future Windows versions will include limited capabilities for Microsoft Digest and will eventually remove support.

This deprecation and hardening mean that simply setting UseLogonCredential = 1 is no longer sufficient to force LSASS to keep reusable cleartext passwords in memory in the way older attack techniques assumed. The platform is intentionally designed to prevent exactly the cleartext extraction scenario being attempted.

Because of this:

Cleartext passwords may not be stored in LSASS at all, even with UseLogonCredential = 1, due to the deprecation and hardening of Microsoft Digest on Windows 11.
There is no supported process in the provided documentation to “fully enable” WDigest on Windows 11 25H2 for the purpose of extracting cleartext passwords from LSASS. The official guidance instead focuses on disabling WDigest credential caching (UseLogonCredential = 0) and treating any remaining Microsoft Digest capability as legacy and on a path to removal.

For security baselines and supported configuration, the recommended and documented state is:

Keep WDigest Authentication disabled by ensuring UseLogonCredential = 0 under SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest.
Follow the Windows security baseline guidance, which treats enabling WDigest credential caching as a non-compliant, high-risk configuration.

References: