Microsoft: “It’s Not A Bug, It’s A Feature!”

Windows RDP is a mechanism for doing remote GUI logins to a Dimdows
machine. It turns out that RDP has a “feature” whereby it continues to
allow you to log in using an old password, even after that password
has been revoked.

Microsoft doesn’t seem to see this as a security issue at all:

    In response, Microsoft said the behavior is a “a design decision
    to ensure that at least one user account always has the ability to
    log in no matter how long a system has been offline.” As such,
    Microsoft said the behavior doesn’t meet the definition of a
    security vulnerability, and company engineers have no plans to
    change it.

Not only that, the problem had been reported to the company by another
security researcher nearly two years earlier:

    "We originally looked at a code change for this issue, but after
    further review of design documentation, changes to code could
    break compatibility with functionality used by many applications."

<https://arstechnica.com/security/2025/04/windows-rdp-lets-you-log-in-using-revoked-passwords-microsoft-is-ok-with-that/>