4

If I save a password for a scheduled task, or in a service's logon credentials, is it safe?

It seems to me that Windows saves this password encrypted somehow, but since Windows has to decipher it, so can anyone with offline access to the computer.

Is it true? Are there tools available to recover these passwords?

8

With Task Scheduler 2.0 (Vista and newer) passwords are saved using the Windows Credential manager:

Task Scheduler in Windows Vista supports a new credential manager that forms part of the security isolation model. In this model, each set of tasks that runs in a specific security context starts in a separate session. Passwords are now stored in the Credentials Manager (CredMan) service. You can use encryption interfaces with CredMan to prevent malware from stealing stored passwords.

Technically, the Credential Manager ("Credential Locker" in newer Windows Versions) is storing the passwords on the local disk:

Users may choose to save passwords in Windows by using an application or through the Credential Manager Control Panel applet. These credentials are stored on the hard disk drive and protected by using the Data Protection Application Programming Interface (DPAPI). Any program running as that user will be able to access credentials in this store.

(emphasis added)

Although Credential Manager improves encryption methods and the security architecture over the deprecated Protected Storage (PStore) service used with the earlier version of Task Scheduler, what growse had written is still valid: whatever is saved can be retrieved, no matter if tools are publicly available for this task yet.

3
  • +1 for Windows Credential Manager - didn't know they'd switched task scheduler to use this instead.
    – growse
    Dec 18 '11 at 18:04
  • @the-wabbit, your first 'Credential manager' link seems to be broken, and I am not sure what it should be updated to. Got any ideas?
    – Zoredache
    Aug 23 '16 at 0:01
  • @Zoredache one or two. Should be better now.
    – the-wabbit
    Aug 24 '16 at 9:59
2

My understanding is that the passwords are stored in DPAPI. So yes, they're stored locally, but they're not stored in plaintext and require the correct encryption key to be able to recall / decrypt them. From distant memory in working with this stuff, the encryption key is derived from the credentials of the current logged in user who is storing the information, so, in theory, only that user can pull the data out and decrypt it.

In the case of the task scheduler, I imagine the data is stored by the account that the task scheduler runs as, so anyone who can impersonate this account (might be SYSTEM by default) can retrieve the data.

"Is it safe" is an entirely subjective question. Unless you encrypt data on disk and keep the key well away from disk, it can, theoretically, be retrieved.

2

Yes, there are tools to extract credentials stored for a Scheduled Task. These tools require elevated privileges, much like other tools for credential extraction.

For example:

  • Download psexec
  • Download nirsoft's netpass
  • Use psexec to launch netpass in SYSTEM's context

So! If psexec is in my PATH, and netpass.exe is in C:\, I could run this:

psexec -i -s -d C:\netpass.exe

This will open netpass, where you will see credentials for scheduled tasks with a runas account. I've tested this with standard domain accounts, on Windows Server 2008 R2 and Window Server 2012 R2. There may be limitations in newer operating systems, or with certain types of accounts.

Cheers!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.