Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If I save a password for a scheduled task, or in a service's logon credentials, is it safe?

It seems to me that Windows saves this password encrypted somehow, but since Windows has to decipher it, so can anyone with offline access to the computer.

Is it true? Are there tools available to recover these passwords?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

With Task Scheduler 2.0 (Vista and newer) passwords are saved using the Windows Credential manager which is different from the Protected Storage service used with the earlier version of Task Scheduler. See the "Credentials Management Using New Security Services" section of the appropriate TechNet documentation on the new Task Scheduler features. But in any way what growse had written is still valid - whatever is saved can be retrieved - no matter if tools are publicly available for this task yet.

share|improve this answer
    
+1 for Windows Credential Manager - didn't know they'd switched task scheduler to use this instead. –  growse Dec 18 '11 at 18:04

My understanding is that the passwords are stored in DPAPI. So yes, they're stored locally, but they're not stored in plaintext and require the correct encryption key to be able to recall / decrypt them. From distant memory in working with this stuff, the encryption key is derived from the credentials of the current logged in user who is storing the information, so, in theory, only that user can pull the data out and decrypt it.

In the case of the task scheduler, I imagine the data is stored by the account that the task scheduler runs as, so anyone who can impersonate this account (might be SYSTEM by default) can retrieve the data.

"Is it safe" is an entirely subjective question. Unless you encrypt data on disk and keep the key well away from disk, it can, theoretically, be retrieved.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.