A customer had turned on the Require trusted path for credential entry<\/i> policy (under Computer Configuration, Administrative Templates, Windows Components, Credential User Interface). They demanded that Microsoft provide clear written documentation that the policy is no longer recommended.<\/p>\n
This was an interesting demand, because that setting was never recommended in the first place.<\/p>\n
Aaron Margosis<\/a>, who knows a lot about recommended security settings, confirmed that that setting was never in any Microsoft-published security baseline. He recalls that it was part of a draft government baseline, but was quickly removed and never made it past the draft stage. Aaron even gave a talk titled Unintended Consequences of Security Lockdowns<\/i><\/a> where he demonstrates how useless that policy is:<\/p>\n