Microsoft's upcoming Windows 10 Fall Creators Update and Windows Server 2016 RS3 update won't support syskey.eye anymore.
Syskey.exe was introduced in Windows 2000, backported to Windows NT 4.0, and has been part of any version of Microsoft Windows released since then.
The tool was designed to improve the security of the Windows boot process by adding another layer of protection to it.
What Syskey.exe does basically is move the Security Accounts Management Database (SAM) encryption key to another location, usually a floppy drive or USB Flash drive. Syskey may also be used to add another password to the startup process of the Windows operating system. This password encrypts the SAM database so that it needs to be supplied for access to it.
Starting with the release of the Windows 10 and Windows Server 2016 Fall Creators Update, syskey.exe will no longer be included in Windows.
Additionally, Windows won't support installing an Active Directory domain controller anymore using Install-From-Media that was externally encrypted by syskey.exe.
Windows 10 or Windows Server 2016 machines that are making use of syskey.exe for extra security won't upgrade to the Fall Creators Update.
The use of syskey.exe needs to be disabled on these machines to upgrade them to the latest version of Windows 10 and Windows Server 2016:
Microsoft makes the change because the encryption key used by syskey is no longer considered secure. Other reasons provided by Microsoft are that syskey encryption is based on weak cryptography, that syskey does not protect all files of the operating system, and that syskey has been used in some ransomware attacks.
Unfortunately, the syskey encryption key and the use of syskey.exe are no longer considered secure. Syskey is based on weak cryptography that can easily be broken in modern times. The data that is protected by syskey is very limited and does not cover all files or data on the OS volume. The syskey.exe utility has also been known to be used by hackers as part of ransomware scams.
Active Directory previously supported the use of an externally encrypted syskey for IFM media. When a domain controller is installed by using IFM media, the external syskey password had to be provided as well. Unfortunately, this protection suffers from the same security flaws.
The company suggests that system administrators and users make use of BitLocker encryption instead to add extra security to the Windows machine and data.
Users who don't want to or cannot use BitLocker, may use third-party solutions such as VeraCrypt instead.
Now You: Do you use extra protection on your devices?
Advertising revenue is falling fast across the Internet, and independently-run sites like Ghacks are hit hardest by it. The advertising model in its current form is coming to an end, and we have to find other ways to continue operating this site.
We are committed to keeping our content free and independent, which means no paywalls, no sponsored posts, no annoying ad formats (video ads) or subscription fees.
If you like our content, and would like to help, please consider making a contribution:
Ghacks is a technology news blog that was founded in 2005 by Martin Brinkmann. It has since then become one of the most popular tech news sites on the Internet with five authors and regular contributions from freelance writers.