Windows RDP lets you log in using revoked passwords.

[sigma]

Quote

The Remote Desktop Protocol—the proprietary mechanism built into Windows for allowing a remote user to log in to and control a machine as if they were directly in front of it—however, will in many cases continue trusting a password even after a user has changed it. Microsoft says the behavior is a design decision to ensure users never get locked out.

 

 

Quote

Even after users change their account password, however, it remains valid for RDP logins indefinitely. In some cases, Wade reported, multiple older passwords will work while newer ones won’t. The result: persistent RDP access that bypasses cloud verification, multifactor authentication, and Conditional Access policies.

 

 

https://arstechnica.com/security/2025/04/windows-rdp-lets-you-log-in-using-revoked-passwords-microsoft-is-ok-with-that/

 

[lparry]

I think a lot of the headlines I've seen regarding this includes a bit of scaremongering.

 

Happy to be corrected as always but from what I can gather, this is just a case of the server using cached credentials in the event that it cannot speak to the directory/entra which may not be the most secure design but I can see why it exists. Disabling cached credentials via GPO should fix this if deemed an issue.

[dmj]

15 minutes ago, lparry said:

I think a lot of the headlines I've seen regarding this includes a bit of scaremongering.

 

yeah, I don't think I've ever seen it recommended to run RDP directly on the internet without a proxy( Guacamole  et al) in front.

 

[MrEprise]

I seem to remember from past experience (and I've just tested it now) that this only happens if you're already logged into a PC and you RDP into it after you've changed the password. Effectively what happens is it'll let you in with the old password and then prompt you to lock and unlock the PC to update its cached credentials.

 

If you RDP into a computer without any user logged in, it won't allow you to login with old credentials.

[mikes]

yeah I've tried old passwords to get into systems here and they never worked so I was a bit confused, but they were live systems; it's a bit baffling someone would write this saying "in some cases it will use old passwords and not accept the latest one" - if this is referring to cached credentials of course it will use the last known cached password, if it can't communicate with the DC how would it ever know the latest password?   It would be the same logging onto the station locally