Hacker News Reader

> Keeping your password in memory like that is pretty sketchy IMO.

Every Windows version since "... for Workgroups" keeps the passwords of every logged-in user in memory as plaintext. This fact is widely exploited for privilege escalation and lateral movement in Windows environments.

View on HN

Which is why recently Microsoft has been pushing very hard to replace the account login password with a TPM managed PIN. This way the (Microsoft) account password is rarely needed and never stored in memory.

Local security authority protection changes this.

Do I understand it correctly that LSA Protection leverages VBS/VSM such that the "actual" Windows instance is punted into a VM while LSASS and friends run in a separate VM, with communication between the two controlled by a specialized version of Hyper-V?

See https://learn.microsoft.com/en-us/windows-server/security/cr...

Reply on news.ycombinator.com