Windows Remote Desktop Protocol Allows Persistent Access with Old Passwords Despite Changes

A recent security investigation has revealed a concerning behavior in Windows Remote Desktop Protocol (RDP): even after a user changes their password, the old password can still be used to log in remotely through RDP. This occurs because Windows caches credentials locally, validating them against stored data rather than checking online status or recent changes. Security researcher Daniel Wade reported the issue, noting that this undermines the widely accepted expectation that changing a compromised password immediately cuts off unauthorized access. Wade describes the situation as a ‘trust breakdown,’ since users and administrators are unaware that old credentials remain valid for remote access, even if the password was changed due to a breach. Microsoft has acknowledged the behavior, stating it is a deliberate design choice to prevent users from being locked out of their systems, especially if the device has been offline. However, this means that attackers who have obtained a user’s old password can maintain persistent access to a machine via RDP, bypassing cloud verification, multi-factor authentication, and Conditional Access policies. Microsoft has updated its documentation to clarify this behavior, but the guidance is hard to find and does not provide clear mitigation steps. Security experts criticize the approach, arguing it creates a silent backdoor and exposes millions of users-especially in small businesses and hybrid work environments-to unnecessary risk. Microsoft maintains that this does not constitute a security vulnerability and has no plans to change the protocol.