Windows 10 Fall Creators Update: syskey.exe support dropped

Martin Brinkmann
Jun 26, 2017
Updated • Sep 14, 2018
Windows, Windows 10
|
16

Microsoft's upcoming Windows 10 Fall Creators Update and Windows Server 2016 RS3 update won't support syskey.eye anymore.

Syskey.exe was introduced in Windows 2000, backported to Windows NT 4.0, and has been part of any version of Microsoft Windows released since then.

The tool was designed to improve the security of the Windows boot process by adding another layer of protection to it.

What Syskey.exe does basically is move the Security Accounts Management Database (SAM) encryption key to another location, usually a floppy drive or USB Flash drive. Syskey may also be used to add another password to the startup process of the Windows operating system. This password encrypts the SAM database so that it needs to be supplied for access to it.

Syskey.exe end of life

Starting with the release of the Windows 10 and Windows Server 2016 Fall Creators Update, syskey.exe will no longer be included in Windows.

Additionally, Windows won't support installing an Active Directory domain controller anymore using Install-From-Media that was externally encrypted by syskey.exe.

Windows 10 or Windows Server 2016 machines that are making use of syskey.exe for extra security won't upgrade to the Fall Creators Update.

The use of syskey.exe needs to be disabled on these machines to upgrade them to the latest version of Windows 10 and Windows Server 2016:

  1. Open a command prompt, type syskey, and hit the Enter-key.
  2. Select Update when the "Securing the Windows Account Database" window opens.
  3. Select Password Startup on the next screen.
  4. Select System Generated Password.
  5. Select Store Startup Key Locally. This saves the key to the hard disk of the local computer.
  6. Click okay twice to complete the process.

Security issues in syskey

Microsoft makes the change because the encryption key used by syskey is no longer considered secure. Other reasons provided by Microsoft are that syskey encryption is based on weak cryptography, that syskey does not protect all files of the operating system, and that syskey has been used in some ransomware attacks.

Unfortunately, the syskey encryption key and the use of syskey.exe are no longer considered secure. Syskey is based on weak cryptography that can easily be broken in modern times. The data that is protected by syskey is very limited and does not cover all files or data on the OS volume. The syskey.exe utility has also been known to be used by hackers as part of ransomware scams.

Active Directory previously supported the use of an externally encrypted syskey for IFM media. When a domain controller is installed by using IFM media, the external syskey password had to be provided as well. Unfortunately, this protection suffers from the same security flaws.

The company suggests that system administrators and users make use of BitLocker encryption instead to add extra security to the Windows machine and data.

Users who don't want to or cannot use BitLocker, may use third-party solutions such as VeraCrypt instead.

Microsoft announced the change on a new Support web page on the official Microsoft Support website. (via Deskmodder)

Now You: Do you use extra protection on your devices?

Summary
Windows 10 Fall Creators Update: syskey.exe support dropped
Article Name
Windows 10 Fall Creators Update: syskey.exe support dropped
Description
Microsoft's upcoming Windows 10 Fall Creators Update and Windows Server 2016 RS3 update won't support syskey.eye anymore.
Author
Publisher
Ghacks Technology News
Logo
Advertisement

Tutorials & Tips


Previous Post: «
Next Post: «

Comments

  1. Anonymous said on August 7, 2020 at 12:47 pm
    Reply

    now the fake tech support trackers(Jim browing example will hate this update cause the cannot syskey the scammers :(

  2. MazTerGee said on June 27, 2017 at 3:07 pm
    Reply

    This will definitely stop the tech support scammers locking people out of their machines because they don’t pay up. Well done MS.. Even though I now sub Syskey.exe with a Dummy file on all my customers computers.

  3. Killian said on June 27, 2017 at 12:39 pm
    Reply

    It happens if you click on another window before the consent.exe uac prompt has appeaed on screen.

    I can make it happen every time by right-clicking, run as admin, then very quickly clicking somewhere else before the uac prompt appears.

  4. CHEF-KOCH said on June 26, 2017 at 4:22 pm
    Reply

    Anyone know if there will be an LTSB update for RS3?

    Last ‘ve heard they said 2019 (next .iso). But I’m pretty sure they released a refresh or RS3 iso but I have no source on that for confirmation.

    1. Justin said on June 27, 2017 at 9:06 pm
      Reply

      LTSB builds were originally supposed to be every 2 years. But they pretty much screwed that up when they released a new one a year later. Anywho they seem to be skipping the early builds in the year and releasing them for the later builds so it would make sense that we’ll see a new LTSB build towards the end of 2017. However that remark about not needing anything until 2025 was just ridiculous.

      1507 was released 07/29/2015
      1607 was released 08/02/2016

    2. Yuliya said on June 26, 2017 at 6:34 pm
      Reply

      I doubt there will be any new LTSB build until 2019 (more likely) or 2018. It will be in line with Server 2016R2 or whatever they will call it. But why do you need new LTSB build? 2016 build is worse than 2015, anything newer will only worsen. They even removed the Win32 UAC consent window in 1703. The new “immersive” one is buggy as hell, often spawning behind other windows. Stick with 1507 for as long as you can if you like Win10. Use 1607 if you have a Nvidia “Pascal” GPU otherwise no need to switch to a newer LTSB build until 2025.

      1. Jed said on June 26, 2017 at 11:45 pm
        Reply

        How odd, well it definitely happens, and it even happened to me from time to time when I was on Windows 7.

      2. Yuliya said on June 26, 2017 at 9:00 pm
        Reply

        Jed, I never had that issue on 7 or LTSB2016 with Win32 consent window. Only the immersive one pops up behind explorer window and sometimes I have to minimise everything (click on show desktop button) to be able to interact with it.

      3. Jed said on June 26, 2017 at 7:57 pm
        Reply

        UAC coming up behind other windows has been a bug since Windows 7 afaik, it happens on my mum’s PC, which for now is still on Windows 7.

  5. cryohellinc said on June 26, 2017 at 2:03 pm
    Reply

    In the meantime an Indian tech support guy got a heart attack after this news.

    1. MazTerGee said on June 27, 2017 at 3:06 pm
      Reply

      Love it :D

    2. amplak said on June 26, 2017 at 9:44 pm
      Reply

      What are you referring at? Thanks

    3. TianlanSha said on June 26, 2017 at 3:20 pm
      Reply

      how will he ever make money now?! ?! ?!

      1. someone1234 said on May 13, 2020 at 6:01 am
        Reply

        It’s actually quite easy to make a diy syskey like ransomware

      2. Anonymous said on July 21, 2020 at 6:33 pm
        Reply

        Dont tell… Like how, what engine will provide the whole system lock? Yeah just copy it from 8.1 and run in win10 compatibilty mode…

      3. insanelyapple said on June 26, 2017 at 3:55 pm
        Reply

        By making yet another copy-paste post with “guidelines” to solve someone’s problem on answers.microsoft.com, of course, without reading into actual problem.

        And yes, that happens.

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

We love comments and welcome thoughtful and civilized discussion. Rudeness and personal attacks will not be tolerated. Please stay on-topic.
Please note that your comment may not appear immediately after you post it.