System Policies for the Windows network passwords caching management

The article is dedicated to the System Policies, which controls the network passwords caching in Windows 95/98/ME.

The problem of passwords caching, on the other hand, their storage on the local drive, and concerning this the security threat, appeared in Windows for Workgroups 3.11 and still exists in 32-bit Windows. The files with "*.PWL" extensions, which were used to store the enciphered local copies of passwords used for access to the network and net resources in Windows for Workgroups 3.11, passed to the 32-bit Windows versions: 95/98/ME.

The Microsoft realisation of DES algorithm, which enciphers the password, was compromised several times. Discussion of this is out of frames of this article, dedicated to the Windows administering there were published a lot of articles and utilities breaking the weak cryptographic defense.

These files are created in the folder, where the Windows was installed. This folder will be the booting one. Soon of all, this directory will be "C:\Windows" for Windows 9.X/ME. If this folder was renamed, it is possible to determine its location simultaneously with all environmental variables through typing "set" in DOS command prompt. The environmental variable "windir" reveals the sought path. The passwords are cached to the files named USERNAME.PWL, where "USERNAME" is user named given while logging on or accessing the resource.

Besides, the list of files for cached passwords copies is kept in the in "System.ini" initialisation file, which is also stored in Windows boot directory. The section "[Password Lists]" is created in this file, where are stored the strings like "USERNAME =C:\WINDOWS\USERNAME.PWL", "User name=full file name with cached password". When user registers in the system, Windows check this list containing the references to the files with passwords. First eight letters of user name are taken to form the file name. If the file with such a name exits, it is overwritten.

Microsoft solved partially the problem of weak cryptographic algorithm released the Service Pack 1 for Windows 95 and updated version of Windows 95 OSR1 (OEM Service Release 1). The key length was enhanced from 32 bit to 128.

The Windows 9.X and ME operating system can be classified as D class of protection according to the "Orange Book". In them it is possible to stroke simply the Esc key or Cancel button in order to bypass the password dialog box, on condition that the system is not a part of domain and not demanded the obligatory verification procedure. The password in Windows 9.X/ME is necessary for the network resources access and not crucial for the boot of very operating system. On the other hand, they can be classified as systems allowing "the open and not restricted access". The protection of client machines working under Windows 9.X/ME control can not be even compared with the protection of servers. The breakers are ruled with the same "admissible hypothesis", to attack them, gaining later the access to the protected resources.

Microsoft offers the next system policies as one of the partial solution to this problem.

Disable Password Caching

This system policy disables the network passwords caching. When it is in active state, the passwords are not cached, but user is to enter the password each time while attempting to access the password-protected resource. "By default" the policy is disabled in the system.

Its state is represented with the pair of Boolean values, which is stored in "DisablePwdCaching" parameter, in the "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Network" system registry key. Although, the type DWORD is recommended for this value in MSDN, this policy will work in Windows 95/98/ME with "DisablePwdCaching" value of binary type. DWORD-value takes "1" and "0", the binary - "01 00 00 00" and "00 00 00 00". The first of pair of values stands for the active state of the policy. The missing of value in the system registry sets the policy to disabled state.

This key is located in HKEY_LOCAL_MACHINE hive and the range of this policy covers not the Current User, but all the system (Local Machine). When it is enabled, the "Change Windows Password" password is blocked in the "Passwords" applet in "Control Panel", showing that the passwords can not be changed. The second dialog box for the confirmation of new password is also disappeared.

If the persistent connections with the password-protected resources are created, then after enabling the policy, the Quick Logon feature for the Microsoft network client can not be used effectively, when there is no automatic verification that all network connections are ready, but network connections are restored while they are required.

"Disable Password Caching" does not erase the file list in "System.ini". The files with "*.PWL" are also remained and, and they must be deleted manually, if needed.

The active state of this policy has an effect for the caching of passwords, which are entered in the forms of browser Internet Explorer, when the AutoComplete is enabled. The cached passwords are "lost" after the system reboot, notwithstanding the states of check boxes "Prompt me to save passwords" and "User names and passwords on forms" which control the password caching in browser. These boxes are on the "Content" page in "Personal information" in browser "Internet Options (Properties)".

Disable Domain Password Caching

While in active state this system policy disables the caching of the passwords for the access to domain or domain network resources.

The numeric "NoDomainPwdCaching" value, located in "Network\Logon" key, in HKEY_LOCAL_MACHINE system registry hive, stands for its representation. The range of the policy covers all the system. The "1" value brings it to enabled state, "0" or absence - to disabled. "By default" the policy is not present in the system.

The implementation in Activity and Authentication Analyzer

In order to see the state of above-mention policy "Disable Password Caching" or to manipulate it in Activity and Authentication Analyzer follow in the left navigation pane next way:

Computer Administration then Control Panel, then Passwords and find it in the right list item corresponding to this policies named:

• Disable Password Caching

Policies for the passwords caching management in Internet Explorer

The article gives the System Policies, which manage the caching, on the other hand, saving to the local drive, the passwords in Internet Explorer.

The dialog box will appear, requesting additional credentials whether to save or not password, after the password is entered to the form window in Internet Explorer. Later, the password will not to be entered once more time, when the same page with the same input form is opened. That is the very password caching.

On the one hand, the password caching is the obvious facility for user, who may even forget the entered password, on other hand, is the serious security threat, because the unhampered access to password-protected resource is possible, it is enough for this to know its exact name. If in Windows the automatic completion for the addresses or forms in Windows or Internet Explorer is enabled, so called AutoComplete, the task is simplified to minimum. The very feature of automatic completion gives out the item list, while exploring which it is possible to guess the exact name of resource. The one taken item given by automatic completion can be deleted from the list. The item must be selected and the DEL must be clicked afterwards. However, this feature does not for the drop-down addresses list entered in Internet Explorer address box.

If one opens in browser "Internet Options (Properties)" the page with "Content" tab, one can see the "AutoComplete" button. On clicking this button, the dialog box appears containing the check boxes for the control over "Use AutoComplete for": "Web addresses", "Forms", "User names and passwords on forms" and "Prompt me to save passwords". The password caching in Web pages forms can be totally disabled with check box named "User names and passwords on forms". The check box "Prompt me to save passwords" deselecting disables all the further caching, but, the passwords, entered before, are still automatically suggested, when the user name is entered in the same form. The passwords AutoComplete prohibition in settings does not clean the information on names and passwords corresponding to them, which is already entered before, which; there are to buttons for this to "Clear AutoComplete history", which are located below, in the same dialog box, named: "Clear Forms", "Clear Passwords".

The full consideration of the AutoComplete feature is out of this article topic. I note two facts in conclusion. The AutoComplete settings, stored addresses, are common either for Internet or Windows Explorer. The last fact: the AutoComplete is nice tool to implement the activity analysis and to reconstruct the user's work.

To avoid unnecessary reiteration and potential discrepancies, caused by the difference inherent to various browsers versions, presence the installed services packs, various Windows versions, I must at once notice, that all the given information was tested on Windows ME, Internet Explorer 5.5, with installed service pack for 128-bit cipher strength.

Disable Password Caching

Here the talk will be about how to disable the password caching in Internet Explorer. This system policy has restricted application. The information given here concerns: the Internet Explorer of 4.01 version with the 2nd service pack installed, the Internet Explorer of 5 and 5.01 versions, working on Windows 95, 98, NT 4.0 and the Internet Explorer 5.01 for Windows 98 Second Edition. For instance, the Internet Explorer of 5.5 version ignored this policy, while performing the test on Windows ME.

The state of this system policy is stored in the numeric "DisablePasswordCaching" value, which must be in "Software\Microsoft\Windows\CurrentVersion\Internet Settings" system registry key, in HKEY_CURRENT_USER hive. Correspondingly, the policy range spreads over the Current User only, but not over all the system. The "1" value enables the policy, the "0" value or its missing disables the policy. "By default" this policy is in disabled state in Internet Explorer and there is password caching in Internet Explorer.

The Microsoft company releases the article Q229940 in MSDN titled: "How to Disable Internet Explorer Password Caching".

Do not allow AutoComplete to save passwords

This system policy has the similar purpose to the previous one. While in active state this system policy disables the automatic completion of the names and passwords in Web-pages forms and prevents from appearance the dialog boxes requesting whether to save or new password. If this policy is enabled, the check boxes "User names and passwords on forms" and "Prompt me to save passwords" become dimmed, showing that blocked both these features and the very possibility to switch them on.

One must select the page with "Content" tab in "Internet Options (Properties)" settings, and later click the "AutoComplete" button in order to see these check boxes.

The value "FormSuggest Passwords", storing this policy, is located in "Software\Policies\Microsoft\Internet Explorer\Control Panel", in HKEY_CURRENT_USER hive. The range of this policy covers only the Current User, registered in the system, but not all the system on the whole. It is not necessary to reboot all the system but will be enough to reload the very browser, closed before this all its instances, to take this policy into effect, when its state is changed.

It is demonstrative, that the Microsoft realisation of this policy provokes more than perplexity. The "FormSuggest Passwords" value can be either of numeric (DWORD) or binary or string type. The missing of value in the system registry brings the policy to the disabled state - state "by default". If the value is of numeric type, the two Boolean values: "1", gives the active state, and "0", which gives disabled, respectively, stands for the representation of two states. When the value is of binary type, it can have two possible values: "01 00 00 00" for active state and "00 00 00 00" for not active.

The strangest reaction of this policy was on the content of this value of string type. The empty string or the "yes", "no", "1" and "0"content bring the policy to active state. The strings "true" and "false" or total missing of value cancel its effect. The symbol case had no effect.

The active state of the policy for "prohibition for AutoComplete to save passwords" does not lead to erasing the information that is already entered into history journal, which stores the names and corresponding to them passwords.

And last note: the "FormSuggest Passwords" value, storing in "Software\Policies\Microsoft\Internet Explorer\Control Panel" key and the value with the same name, which can be stored in "Software\Microsoft\Internet Explorer\Main" key, possibly appearing in either HKEY_LOCAL_MACHINE, or HKEY_CURRENT_USER hives are not to be mixed. The last value belongs to the browser setting, storing the state of check box with name "User names and passwords on forms".

The implementation in Activity and Authentication Analyzer

In order to see the state of above-mention policy "Disable Password Caching" or to manipulate it in Activity and Authentication Analyzer follow in the left navigation pane next way:

Computer Administration then Internet Explorer and find it in the right list item corresponding to this policies named:

• Disable Password Caching

In order to see the state of above-mention policy "Do not allow AutoComplete to save passwords" or to manipulate it in Activity and Authentication Analyzer follow in the left navigation pane next way:

Computer Administration then Internet Explorer, then IE Tools and find it in the right list item corresponding to this policies named:

• Do not allow AutoComplete to save passwords

System Policies for Password applet of Control Panel

The article is dedicated to the System Policies for the Password applet of Control Panel for Windows 95, 98, ME.

Passwords in the common sense resemble the key and the lock and, when humankind begot the division to the native and the strange, there appeared the problem of authentication. The password management is inseparable part of any system security rules and simultaneously the main target for the computer malefactors.

The system policies for Windows 95, 98 and ME, destined for the restriction of the accessible for the user actions in Passwords applet, which is located in Control Panel are represented in this article. The Password applet has three pages: "Change Passwords", "Remote Administration" and "User Profiles". The "Remote Administration" page will appear after the installation of the relevant services. The "Change Passwords" tab contains the controls: "Change Windows" and "Change other Passwords". The "Remote Administration" tab is used for enabling and further managing the "Remote administration". The customised (personal) preferences for the different users for the Desktop, Network Neighbourhood, Start menu and Programs menus can be enabled on the "User Profiles" page. The below-given system policies were designed for single-user, or how it went in fashion to name: "client", Windows systems. I do not intentionally introduce the detailed descriptions for the functions or purposes of these or others settings of "User Profiles" or "Remote Administration" in order not to go away from the topic of Password administration in Windows 9.x. The Passwords management in Windows NT or 2000 is also out of this article topic.

All the policies given in the article have a lot of common features. All of them are Boolean, in other words, can have only two states. They have the scope of the Current User only, and all are stored in the HKEY_CURRENT_USER system registry hive. The values corresponding to their states are numeric (DWORD) and can be equal to "1", enabling the policy and to "0", disabling it. The policies are absent in the system by default. If there is no corresponding value in the system registry, this is equivalent to the "0" and disables the policy. All the policies are stored in "Software\Microsoft\Windows\CurrentVersion\Policies\System" key.

Disable Passwords in Control Panel

This policy, stored in "NoSecCPL" value, prohibits from launching the Passwords applet in Control Panel, thus, protecting from changing the system settings concerned with the system security. While making an attempt to access there appears the message that the system administrator restricted the Passwords applet.

Hide Change Passwords Page

The state of this policy is stored in the "NoPwdPage" value. When the policy is in enabled state, the access to the "Change Passwords" page is closed. This page is removed from the Passwords applet and Windows passwords can not be changed through this applet in Control Panel.

Hide Remote Administration Page

The value "NoAdminPage" responds for the hiding of the "Remote Administration" page. If the policy is enabled, there is no access to "Remote Administration" page, since the page is removed from the Passwords applet and it will be impossible to change the settings through the applet in Control Panel.

Hide User Profiles Page

The value "NoProfilePage", being equal to "1", turns this policy to the enabled state and the "User Profiles" page is removed from the Passwords applet. Thus, the applet using to change "User Profiles" settings is forbidden.

The implementation in Activity and Authentication Analyzer

In order to see the state of above-mentioned policies or to manipulate them in Activity and Authentication Analyzer follow in the left navigation pane next way:

Computer Administration then Control Panel, Passwords item after this, and find in the right list items corresponding to these policies named:

• Disable Passwords in Control Panel
• Hide Change Passwords Page
• Hide Remote Administration Page
• Hide User Profiles Page