Why does reaching a host by RDP leave the operator's credential on that host, while remote service creation or WMI does not?

## Not all remote logons cost the same Every one of the estate's remote-admin channels authenticates the operator, but they do not all leave the same thing behind on the destination. The difference is the **logon type** each one produces, and it decides whether the operator's own credential ends up sitting on the target for someone else to take. ## Interactive versus network logon Windows classifies logons by type. Two matter here: - **Interactive / RemoteInteractive (RDP) — logon type 10.** This draws a desktop session for the account. To run that session, the host materialises the account's **reusable secrets** in memory. They stay resident for the life of the session. - **Network — logon type 3.** Used by the admin-share service-create and by WMI. It proves the credential to the target and runs the requested code, but it does **not** cache the account's reusable secrets on that host by default. So the same credential, used two different ways against the same host, leaves two very different residues. ## The reflexive cost Call it the reflexive cost: **the easy channel bites the operator back.** An interactive logon deposits a reusable copy of the credential on the target. If that host is later controlled by anyone else — a rival intruder, or the defenders — the credential can be lifted from memory and reused. This is trivial at one host and decisive at scale. Reaching 900 tills by RDP means 900 hosts now each hold a stealable copy of the operator's credential. Reaching the same 900 by a network-logon channel keeps the credential's exposure at the source. A publicity-deadline crew that wants simultaneous reach and a patient crew that wants dwell both have the same reason to avoid RDP here: it multiplies their own exposure by the size of the fleet. ```text # RDP session to the target -> an interactive class logon on that host: Logon Type: 10 (RemoteInteractive) -> account's reusable secrets are materialised in memory on the target # Remote service-create / WMI to the same target -> a network logon: Logon Type: 3 (Network) -> authenticates, runs, leaves no reusable secret in memory (by default) ``` ## The caveats that keep the claim honest 'Network logon leaves nothing reusable' is a strong default, not an absolute. Configuration can change it: unconstrained delegation can forward the credential, cached-credential settings can retain material, and a channel that deliberately stores a secret for later reuse exposes it too. The safe framing is that a network logon does **not** cache reusable secrets by default, whereas an interactive logon does — so the choice of channel changes the operator's own attack surface, and a good operator treats RDP as the self-exposing option it is. ## Why interviewers ask it The naive answer picks RDP because it is the most familiar and 'feels' safe because the session is encrypted. Encryption protects the wire, not the credential resident on the target. The point being tested is whether you understand that the channel you pick determines what you leave behind on every host you touch.