Re: Microsoft: “It’s Not A Bug, It’s A Feature!”

Windows RDP is a mechanism for doing remote GUI logins to a Dimdows
machine. It turns out that RDP has a “feature” whereby it continues to
allow you to log in using an old password, even after that password
has been revoked.
 Microsoft doesn’t seem to see this as a security issue at all:
      In response, Microsoft said the behavior is a “a design decision
     to ensure that at least one user account always has the ability to
     log in no matter how long a system has been offline.” As such,
     Microsoft said the behavior doesn’t meet the definition of a
     security vulnerability, and company engineers have no plans to
     change it.
 Not only that, the problem had been reported to the company by another
security researcher nearly two years earlier:
      "We originally looked at a code change for this issue, but after
     further review of design documentation, changes to code could
     break compatibility with functionality used by many applications."
 <https://arstechnica.com/security/2025/04/windows-rdp-lets-you-log-in-using-revoked-passwords-microsoft-is-ok-with-that/>