Windows 10 Fall Creators Update: syskey.exe support dropped
Microsoft's upcoming Windows 10 Fall Creators Update and Windows Server 2016 RS3 update won't support syskey.eye anymore.
Syskey.exe was introduced in Windows 2000, backported to Windows NT 4.0, and has been part of any version of Microsoft Windows released since then.
The tool was designed to improve the security of the Windows boot process by adding another layer of protection to it.
What Syskey.exe does basically is move the Security Accounts Management Database (SAM) encryption key to another location, usually a floppy drive or USB Flash drive. Syskey may also be used to add another password to the startup process of the Windows operating system. This password encrypts the SAM database so that it needs to be supplied for access to it.
Syskey.exe end of life
Starting with the release of the Windows 10 and Windows Server 2016 Fall Creators Update, syskey.exe will no longer be included in Windows.
Additionally, Windows won't support installing an Active Directory domain controller anymore using Install-From-Media that was externally encrypted by syskey.exe.
Windows 10 or Windows Server 2016 machines that are making use of syskey.exe for extra security won't upgrade to the Fall Creators Update.
The use of syskey.exe needs to be disabled on these machines to upgrade them to the latest version of Windows 10 and Windows Server 2016:
- Open a command prompt, type syskey, and hit the Enter-key.
- Select Update when the "Securing the Windows Account Database" window opens.
- Select Password Startup on the next screen.
- Select System Generated Password.
- Select Store Startup Key Locally. This saves the key to the hard disk of the local computer.
- Click okay twice to complete the process.
Security issues in syskey
Microsoft makes the change because the encryption key used by syskey is no longer considered secure. Other reasons provided by Microsoft are that syskey encryption is based on weak cryptography, that syskey does not protect all files of the operating system, and that syskey has been used in some ransomware attacks.
Unfortunately, the syskey encryption key and the use of syskey.exe are no longer considered secure. Syskey is based on weak cryptography that can easily be broken in modern times. The data that is protected by syskey is very limited and does not cover all files or data on the OS volume. The syskey.exe utility has also been known to be used by hackers as part of ransomware scams.
Active Directory previously supported the use of an externally encrypted syskey for IFM media. When a domain controller is installed by using IFM media, the external syskey password had to be provided as well. Unfortunately, this protection suffers from the same security flaws.
The company suggests that system administrators and users make use of BitLocker encryption instead to add extra security to the Windows machine and data.
Users who don't want to or cannot use BitLocker, may use third-party solutions such as VeraCrypt instead.
Microsoft announced the change on a new Support web page on the official Microsoft Support website. (via Deskmodder)
Now You: Do you use extra protection on your devices?
In the meantime an Indian tech support guy got a heart attack after this news.
how will he ever make money now?! ?! ?!
By making yet another copy-paste post with “guidelines” to solve someone’s problem on answers.microsoft.com, of course, without reading into actual problem.
And yes, that happens.
It’s actually quite easy to make a diy syskey like ransomware
Dont tell… Like how, what engine will provide the whole system lock? Yeah just copy it from 8.1 and run in win10 compatibilty mode…
What are you referring at? Thanks
Love it :D
Anyone know if there will be an LTSB update for RS3?
Last ‘ve heard they said 2019 (next .iso). But I’m pretty sure they released a refresh or RS3 iso but I have no source on that for confirmation.
I doubt there will be any new LTSB build until 2019 (more likely) or 2018. It will be in line with Server 2016R2 or whatever they will call it. But why do you need new LTSB build? 2016 build is worse than 2015, anything newer will only worsen. They even removed the Win32 UAC consent window in 1703. The new “immersive” one is buggy as hell, often spawning behind other windows. Stick with 1507 for as long as you can if you like Win10. Use 1607 if you have a Nvidia “Pascal” GPU otherwise no need to switch to a newer LTSB build until 2025.
UAC coming up behind other windows has been a bug since Windows 7 afaik, it happens on my mum’s PC, which for now is still on Windows 7.
Jed, I never had that issue on 7 or LTSB2016 with Win32 consent window. Only the immersive one pops up behind explorer window and sometimes I have to minimise everything (click on show desktop button) to be able to interact with it.
How odd, well it definitely happens, and it even happened to me from time to time when I was on Windows 7.
LTSB builds were originally supposed to be every 2 years. But they pretty much screwed that up when they released a new one a year later. Anywho they seem to be skipping the early builds in the year and releasing them for the later builds so it would make sense that we’ll see a new LTSB build towards the end of 2017. However that remark about not needing anything until 2025 was just ridiculous.
1507 was released 07/29/2015
1607 was released 08/02/2016
It happens if you click on another window before the consent.exe uac prompt has appeaed on screen.
I can make it happen every time by right-clicking, run as admin, then very quickly clicking somewhere else before the uac prompt appears.
This will definitely stop the tech support scammers locking people out of their machines because they don’t pay up. Well done MS.. Even though I now sub Syskey.exe with a Dummy file on all my customers computers.
now the fake tech support trackers(Jim browing example will hate this update cause the cannot syskey the scammers :(