Your RPD password is your AD password and that is encrypted and salted (I think). There are some worrying extensions to MSAD but I don't think that unless you tick the box in ADUC that your password will be stored unencrypted, it will be stored unencrypted (hashed or whatever).
We need to understand what:
"...Microsoft said the behavior is a “a design decision to ensure that at least one user account always has the ability to log in no matter how long a system has been offline."
really means.
I'm a Linux jockey but I can't be arsed with nonsense like this.
> one user account always has the ability to log in no matter how long a system has been offline
To me, it's pretty clear.
Assume that every password has an expiration date. Having not logged in to the system long enough, you end up with a system where every password has expired. A relatively reasonable thing to do then is to accept some previously valid password, and direct the user to the password reset flow. Else you end up with a system that rejects every login.
A much more reasonable thing to do would be to accept rescue codes in this situation, of use 2FA so that passwords expiration is not needed. But I bet the security checklists used by some behemoth insurance companies predate these inventions, nobody wants to alter them, and companies who don't want to pay higher IT insurance premiums have to follow these outdated and inefficient practices.
> but I don't think that unless you tick the box in ADUC that your password will be stored unencrypted, it will be stored unencrypted (hashed or whatever).
The only option is to use a 'reversible encryption'.
Your RPD password is your AD password and that is encrypted and salted (I think). There are some worrying extensions to MSAD but I don't think that unless you tick the box in ADUC that your password will be stored unencrypted, it will be stored unencrypted (hashed or whatever).
We need to understand what:
"...Microsoft said the behavior is a “a design decision to ensure that at least one user account always has the ability to log in no matter how long a system has been offline."
really means.
I'm a Linux jockey but I can't be arsed with nonsense like this.