Require trusted path for credential entry

Supported OS tags: Windows10, Windows10RT, Windows11, Windows7, Windows8, Windows81, WindowsRT, WindowsRT81, WindowsServer2008, WindowsServer2012, WindowsServer2012R2, WindowsServer2016, WindowsVista

This policy setting requires the user to enter Microsoft Windows credentials using a trusted path, to prevent a Trojan horse or other types of malicious code from stealing the user’s Windows credentials. Note: This policy affects nonlogon authentication tasks only. As a security best practice, this policy should be enabled. If you enable this policy setting, users will be required to enter Windows credentials on the Secure Desktop by means of the trusted path mechanism. If you disable or do not configure this policy setting, users will enter Windows credentials within the user’s desktop session, potentially allowing malicious code access to the user’s Windows credentials.

This policy has no additional user input fields.

• Computer
  Do not display the password reveal button

  At least Windows Server 2012, Windows 8 or Windows RT or at least Internet Explorer 10
• User
  Do not display the password reveal button

  At least Windows Server 2012, Windows 8 or Windows RT or at least Internet Explorer 10
• Computer
  Enumerate administrator accounts on elevation

  At least Windows Vista
• Computer
  Prevent the use of security questions for local accounts

  At least Windows Server 2016, Windows 10 Version 1903