How do cached credentials affect UAC elevation in Windows 8?
0 reputation · 02 Mar 2020, 12:24 UTC
Windows 8 utilizes User Account Control (UAC) to enforce a least-privilege model, providing administrative users with standard tokens by default. However, the Windows Credential Manager stores NTLM hashes to facilitate offline authentication when the domain controller is unreachable.
When a user's password is changed or expires on the network, the local system may attempt to use stale cached credentials during a UAC elevation prompt. This creates a conflict where the user can log into the desktop standard session but fails to gain administrative rights because the elevation request relies on outdated data.
Does Windows 8 force a refresh of cached credentials immediately upon a UAC prompt failure due to password mismatch, or is there a specific mechanism to invalidate these local tokens without a manual clearing of the Credential Manager?