How do I emulate the extraction of cleartext passwords for the Scheduled Task LogonType password misconfigurations?

FN LN 0 Reputation points
2025-01-27T10:39:11.5866667+00:00

Microsoft Recommendation for configuration of Scheduled Task is "In the new task, if the Task Content: XML contains <LogonType>Password</LogonType> value, trigger an alert. In this case, the password for the account that will be used to run the scheduled task will be saved in Credential Manager in cleartext format, and can be extracted using Administrative privileges." (taken from https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698)

Anyone knows how to validate/emulate that such cleartext passwords can be potentially leaked to an admin account?

I have attempted the following:

  1. In a VM, create admin and normal users. Using the normal user account, create the scheduled task with LogonType Password and trigger the scheduled task. Login with the admin account, and access Credential Manager > Windows Credentials. Tried looking for cleartext passwords to no avail.
  2. In an Active Directory, create Domain Admin and Domain User accounts. Using the Domain User account, create the scheduled task with LogonType Password and trigger the scheduled task. Login with the admin account, and access Credential Manager > Windows Credentials. Tried looking for cleartext passwords to no avail.
Windows 10
Windows 10
A Microsoft operating system that runs on personal computers and tablets.
12,010 questions
Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,987 questions
Windows 11
Windows 11
A Microsoft operating system designed for productivity, creativity, and ease of use.
10,572 questions
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.