is disabling "Store passwords using reversible encryption" option convert passwords to unreversible state?

Question

Hi All!!

I inherited an AD domain and GPO with "Store passwords using reversible encryption" option enabled.
This fact worries me very much, and that is why I want to turn this option to "disabled".
My question: after disabling this option should all my users change their password to "rewrite" it in store in unreversible view? Or it is unnecessary and passwords will rewrite themselves (if I may say so) just after disabling option?

Answer 1

Hi,

Please refer https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption

Read the whole article and address in potential impacts. However the following quote answers your question.

"When policy settings are disabled, only new passwords will be stored using one-way encryption by default. Existing passwords will be stored using reversible encryption until they are changed."

Regards,