Windows 10 Fall Creators Update: syskey.exe support dropped

Microsoft's upcoming Windows 10 Fall Creators Update and Windows Server 2016 RS3 update won't support syskey.eye anymore.

Syskey.exe was introduced in Windows 2000, backported to Windows NT 4.0, and has been part of any version of Microsoft Windows released since then.

The tool was designed to improve the security of the Windows boot process by adding another layer of protection to it.

What Syskey.exe does basically is move the Security Accounts Management Database (SAM) encryption key to another location, usually a floppy drive or USB Flash drive. Syskey may also be used to add another password to the startup process of the Windows operating system. This password encrypts the SAM database so that it needs to be supplied for access to it.

Syskey.exe end of life

Starting with the release of the Windows 10 and Windows Server 2016 Fall Creators Update, syskey.exe will no longer be included in Windows.

Additionally, Windows won't support installing an Active Directory domain controller anymore using Install-From-Media that was externally encrypted by syskey.exe.

Windows 10 or Windows Server 2016 machines that are making use of syskey.exe for extra security won't upgrade to the Fall Creators Update.

The use of syskey.exe needs to be disabled on these machines to upgrade them to the latest version of Windows 10 and Windows Server 2016:

1. Open a command prompt, type syskey, and hit the Enter-key.
2. Select Update when the "Securing the Windows Account Database" window opens.
3. Select Password Startup on the next screen.
4. Select System Generated Password.
5. Select Store Startup Key Locally. This saves the key to the hard disk of the local computer.
6. Click okay twice to complete the process.

Security issues in syskey

Microsoft makes the change because the encryption key used by syskey is no longer considered secure. Other reasons provided by Microsoft are that syskey encryption is based on weak cryptography, that syskey does not protect all files of the operating system, and that syskey has been used in some ransomware attacks.

Unfortunately, the syskey encryption key and the use of syskey.exe are no longer considered secure. Syskey is based on weak cryptography that can easily be broken in modern times. The data that is protected by syskey is very limited and does not cover all files or data on the OS volume. The syskey.exe utility has also been known to be used by hackers as part of ransomware scams.

Active Directory previously supported the use of an externally encrypted syskey for IFM media. When a domain controller is installed by using IFM media, the external syskey password had to be provided as well. Unfortunately, this protection suffers from the same security flaws.

The company suggests that system administrators and users make use of BitLocker encryption instead to add extra security to the Windows machine and data.

Users who don't want to or cannot use BitLocker, may use third-party solutions such as VeraCrypt instead.

Microsoft announced the change on a new Support web page on the official Microsoft Support website.

Now You: Do you use extra protection on your devices?