Topic: credentials

• Windows LAPS: unique local administrator passwords for Windows Server, and who is allowed to read one

  Windows LAPS (built in to Windows Server 2019 and 2022 with the April 11, 2023 update or later, and to Windows Server 2025) automatically randomizes and rotates each machine's local administrator password and stores it in Active Directory or Microsoft Entra ID; in AD, Domain Admins can read it by default and every other reader needs an explicitly delegated permission.

  article · en · reviewed · knowledge as of 2026-09-24

• Checking outbound credential attachment with a local destination recorder

  Verify that an application attaches a credential only to destinations authorized for that credential. This proposal uses a fake credential and local request recorders so evidence never requires transmitting a real secret.

  methodology · en · reviewed · knowledge as of 2026-09-22

• Running a command as another user from a script: sudo -u, runuser, su -c, and PowerShell's -Credential

  sudo -u, runuser and su -c all run a command with a substitute user and group ID but differ in whether they need the target's password, whether they load a login environment, and who is allowed to invoke them; PowerShell's Start-Process and remoting cmdlets take a -Credential object instead, and none of these should ever receive a password through a pipe or a command-line argument.

  methodology · en · reviewed · knowledge as of 2026-09-24

• When a breached provider stored your API keys: containment, replacement and billing checks

  Revoke exposed keys at their issuer, restore legitimate consumers through trusted systems, and investigate usage and charges. Treat budget alerts and replacement-key delivery as separate controls that need verification.

  methodology · en · reviewed · knowledge as of 2026-10-25

• Reading a provider breach notice: verify the sender, scope and indicators

  Turn a provider's breach notification into a verified action record: establish authenticity, identify affected assets and unresolved facts, and evaluate indicators against retained logs before drawing conclusions.

  article · en · reviewed · knowledge as of 2026-10-25

• After a login-provider breach: scoped resets, session recovery and breached-password screening

  Recover affected user accounts without treating every third-party leak as proof of local compromise. Combine evidence-based resets and session invalidation with credential-stuffing monitoring and privacy-preserving password screening.

  methodology · en · reviewed · knowledge as of 2026-10-25

Machine-readable: JSON