Design Over Defense? Microsoft RDP Accepts Old Passwords — And It’s No Accident
A critical concern has emerged in how Windows handles password changes — and it’s not being labeled a flaw. Microsoft has acknowledged that its Remote Desktop Protocol (RDP) continues to allow access using outdated passwords, even after a user has changed them due to compromise or routine updates. But the company insists this behavior is by design.
Instead of classifying it as a vulnerability, Microsoft is defending the practice, saying it’s a deliberate feature meant to maintain access in offline scenarios. That explanation, however, is raising eyebrows across the cybersecurity community.
The issue came into focus after independent security researcher Daniel Wade flagged the behavior to Microsoft’s Security Response Center. Wade discovered that RDP, under certain circumstances, doesn’t check current credentials against Microsoft’s cloud servers. Instead, it falls back on a local cache — and that cache may still accept previous passwords.
In an interview summarized by Ars Technica, Wade criticized the approach: “This isn’t just a bug. It’s a trust breakdown,” he wrote. “Users assume a password change means they’ve cut off unauthorized access. But that’s not what’s happening here.”
The Mechanics Behind the Risk
When users sign in to a Windows device with a Microsoft or Azure account, their password is validated online. A secured hash of that credential is then stored locally. But for future RDP sessions, Windows often bypasses the cloud and checks the password against this local cache — meaning old credentials may remain functional for remote logins.
Even more troubling: users might find that several outdated passwords still work, while the newest one does not.
Security professionals argue this undermines foundational principles of identity management. Will Dormann, senior vulnerability analyst at Analygence, noted: “From a security standpoint, this is irrational. If I change a password, the old one should stop working everywhere. But with RDP, that’s simply not the case.”
This loophole effectively bypasses cloud-based protections such as multifactor authentication and Conditional Access policies — offering attackers a persistent entry point if they’ve previously acquired credentials.
Microsoft’s Position: “Working As Intended”
Microsoft has been aware of the issue since at least August 2023, but has chosen not to alter the underlying behavior. A spokesperson explained the company’s reasoning: the feature ensures access continuity, especially in environments where internet connectivity is unreliable or unavailable.
Instead of issuing a patch, Microsoft updated its documentation to caution administrators. No alerts are triggered when older passwords are used, and its security platforms — including Microsoft Defender and Azure — don’t flag this activity.
Currently, the only mitigations suggested involve adjusting RDP configurations to rely solely on local credentials and reviewing access policies to minimize exposure.
Key takeaways:
- Changing a Microsoft or Azure password doesn’t invalidate prior credentials for RDP.
- There is no user-facing warning when outdated passwords are used for remote logins.
- Microsoft’s security tools do not treat this behavior as suspicious or unsafe.
Implications for Enterprises and Remote Workforces
The broader consequence is a widening gap between user expectations and Windows’ authentication reality. In a world where password changes are seen as the first line of defense against breaches, Microsoft’s stance leaves users — from remote workers to enterprise administrators — vulnerable to unauthorized access without their knowledge.
As long as this behavior remains a “feature,” millions of systems could unknowingly be exposed through outdated credentials that were never properly revoked.
