Glossary
WDigest
A legacy Windows authentication package that, when enabled, keeps plaintext passwords in LSASS memory where credential dumping tools can read them.
WDigest is the Windows implementation of HTTP Digest authentication and SASL, introduced in Windows XP. Because the Digest protocol needs the user's password to compute responses, the WDigest security package historically cached a reversibly usable copy of the password in LSASS memory for every interactive logon. Since the 2014 update KB2871997 and in every release from Windows 8.1 and Windows Server 2012 R2 onward, this caching is off by default and is controlled by the UseLogonCredential value under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest: 0 or absent means no plaintext, 1 turns it back on.
Attackers who gain local administrator rights often set UseLogonCredential to 1 and wait for the next logon, so the value is both a hardening setting and a detection signal. Set it explicitly to 0 through Group Policy (older Microsoft security baselines included the "WDigest Authentication" setting; it was removed from the Windows 11 24H2 baseline as deprecated, so a registry preference also works), monitor the registry key for changes with Sysmon or EDR, and add privileged accounts to Protected Users, which also prevents WDigest from caching credentials.
See Cached logons, WDigest and credential exposure settings and Credential Guard and LSA protection.