US-CERT is aware of continued exploitation of insecurely stored passwords in Group Policy Preferences, due to incomplete implementations of Microsoft Security Bulletin MS14-025. Systems may still be vulnerable to exploitation if administrators have not cleared all previously stored passwords from their environment. An attacker may decrypt these passwords and use them to gain escalated privileges.
US-CERT strongly recommends that administrators employ the PowerShell script provided in Microsoft Knowledge Base Article 2962486 and follow the included instructions for clearing all "CPassword" preferences from their environment.
This product is provided subject to this Notification and this Privacy & Use policy.