This post aims to explore and gain knowledge about how to create a WDigest Authentication Policy using Intune. Our objective is to activate the WDigest Authentication Policy by utilizing the Configuration Profiles available in Intune.
Enabling WDigest authentication allows Lsass.exe to store the user’s password in memory, making it vulnerable to potential theft. Microsoft advises against using WDigest authentication unless necessary. By default, Windows 8.1 and Windows Server 2012 R2 have WDigest authentication disabled if the setting is not configured.
However, in earlier versions of Windows and Windows Server, WDigest authentication is enabled by default. To disable WDigest authentication using this setting in Windows 7, Windows 8, Windows Server 2008 R2, and Windows Server 2012, it is necessary to install Update KB2871997 beforehand.
Enabling this setting enables WDigest authentication while disabling it (which is recommended) disables WDigest authentication. Remember that for this setting to take effect on Windows 7, Windows 8, Windows Server 2008 R2, or Windows Server 2012, KB2871997 must be installed first.
To disable WDigest authentication, Microsoft provides an update called KB2871997. This update must be installed on Windows 7, Windows 8, Windows Server 2008 R2, and Windows Server 2012 systems before the WDigest authentication setting can be effectively disabled. Once the update is installed, the setting can be configured to disable WDigest authentication, which is the recommended option.
It is important to note that disabling WDigest authentication may impact compatibility with certain applications or services that rely on this authentication method. It is essential to thoroughly test and ensure compatibility before disabling WDigest authentication in production environments.
- Audit Process Creation Policy Using Intune
- Best Guide to Apply Audit PNP Activity Policy using Intune
Windows CSP Details WDigestAuthentication
Let’s go through Windows CSP Details for this Policy setting WDigestAuthentication. When WDigest authentication is enabled, the Windows Security Account Manager (LSASS) retains a plaintext copy of the user’s password in memory. This poses a security risk because an attacker who gains access to LSASS memory can potentially extract these passwords. As a best practice, Microsoft recommends disabling WDigest authentication unless it is specifically required for compatibility reasons.
CSP URI – ./Device/Vendor/MSFT/Policy/Config/MSSecurityGuide/WDigestAuthentication
WDigest Authentication Policy using Intune
To create WDigest Authentication Policy Using Intune, follow the steps stated below:
- Sign in to the Intune Admin Center portal https://intune.microsoft.com/.
- Select Devices > Windows > Configuration profiles > Create a profile.
In Create Profile, Select Windows 10 and later in Platform, and Select Profile Type as Settings catalog. Click on Create button.
| Platform | Profile Type |
|---|---|
| Windows 10 and later | Settings Catalog |
On the Basics tab pane, provide a name for the policy as “WDigest Authentication Policy.” Optionally, you can enter a description for the policy and then proceed by selecting “Next.”
Now in Configuration settings, click Add Settings to browse or search the catalog for the settings you want to configure.
In the Settings Picker windows, search by the keyword WDigest, among two, you will see Administrative Templates\MS Security Guide, and select this.
When you select the option as stated above, you will see only one setting, which is Wdigest Authentication (disabling may require KB2871997). After selecting your setting, click the cross mark at the right-hand corner, as shown below.
Now, in the Administrative Templates, Enabled the Wdigest Authentication (disabling may require KB2871997), as shown below in the image.
Using Scope tags, you can assign a tag to filter the profile to specific IT groups. One can add scope tags (if required) and click Next to continue. Now in Assignments, in Included Groups, you need to click on Add Groups, choose Select Groups to include one or more groups, and click Next to continue.
In the Review + Create tab, you need to review your settings. After clicking on Create, your changes are saved, and the profile is assigned.
An automatic notification will be displayed in the top right-hand corner to indicate the successful creation of the “WDigest Authentication Policy.” Additionally, you can verify its presence by checking the Configuration Profiles list, where the policy will be clearly visible.
Your groups will receive your profile settings when the devices check in with the Intune service. The Policy applies to the device.
Intune Report for WDigest Authentication Policy
From Intune Portal, you can view the Intune settings catalog profile report, which provides an overview of device configuration policies and deployment status.
To monitor the assignment of the policy, you must choose the appropriate policy from the list of Configuration Profiles. You can check the device and user check-in status to see if the policy has been successfully applied. If you wish to view more information, you can click on “View Report” to see additional details.
Intune MDM Event Log
To ascertain the successful application of String or integer policies on Windows 10 or 11 devices using Intune, event IDs 813 and 814 can be utilized. By analyzing these event IDs, you can identify both the policy’s application status and the specific value associated with the applied policy on those devices. For this specific policy, the value is a string and is associated with event ID 814.
To confirm this, you can check the Event log path – Applications and Services Logs – Microsoft – Windows – Devicemanagement-Enterprise-Diagnostics-Provider – Admin.
MDM PolicyManager: Set policy string, Policy: (WDigestAuthentication), Area: (MSSecurityGuide), EnrollmentID requesting merge: (4009A089-4FBA-482B-9D17-9E5A8428CB98), Current User: (Device), String: (<enabled />), Enrollment Type: (0xD), Scope: (0x0).
Upon examining the above-mentioned log in the Event Viewer, you will discover crucial details such as the Area and Enrollment ID. These pieces of information are instrumental in identifying the registry path. To find the relevant information, kindly refer to the table provided below:
| Area | Policy | String | Scoped | Event ID |
|---|---|---|---|---|
| MSSecurityGuide | WDigestAuthentication | Enabled | Device | 814 |
The information provided in the above table for WDigest Authentication Policy Using Intune can be utilized to access the registry settings storing group policy configurations on a target computer. By running “REGEDIT.exe” on the target computer, you can navigate to the specific registry path where these settings are stored.
- Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\providers\4009A089-4FBA-482B-9D17-9E5A8428CB98\default\Device\MSSecurityGuide
When you navigate to the above path in the Registry Editor, you will find the registry key with the name WDigestAuthentication. Refer to the table and image below.
| Registry Name | Value |
|---|---|
| WDigestAuthentication | Enabled |
Author
Abhinav Rana is working as an SCCM Admin. He loves to help the community by sharing his knowledge. He is a B.Tech graduate in Information Technology.