{"id":10531,"date":"2021-08-25T18:05:31","date_gmt":"2021-08-26T01:05:31","guid":{"rendered":"https:\/\/www.coretechnologies.com\/blog\/?p=10531"},"modified":"2026-10-19T03:28:07","modified_gmt":"2026-10-19T10:28:07","slug":"windows-password-management","status":"publish","type":"post","link":"https:\/\/www.coretechnologies.com\/blog\/alwaysup\/windows-password-management\/","title":{"rendered":"Q&A: Where does AlwaysUp store the Password for my Windows Account?"},"content":{"rendered":"
\"Q&A:<\/div>\n
\n\"Quotes\"  I was looking to use AlwaysUp to run Excel as a service<\/a>, and it looks like you can specify an account. How is the password stored when specifying an account? I want to make sure it\u2019s stored securely.<\/p>\n

— Ben<\/p>\n<\/div>\n

Good question Ben!<\/p>\n

You’re right to be concerned about security, especially with deadly ransomware attacks<\/a> on the rise.<\/p>\n

Rest assured that AlwaysUp manages your Windows account securely. Here are some of the measures in place to protect your valuable credentials.<\/p>\n

\n
\n
\"\"<\/a><\/div>\n<\/div>\n

AlwaysUp hides your Windows password on the Logon tab<\/h2>\n

As a first line of defense, the field that captures your Windows password “masks” the characters, showing asterisks (“*”) instead of the characters you type:<\/p>\n

\"AlwaysUp<\/a><\/div>\n

By doing so, AlwaysUp hides your password from casual onlookers.<\/p>\n

\n
\n
\"\"<\/a><\/div>\n<\/div>\n

Windows stores your password — not AlwaysUp<\/h2>\n

Next, and more importantly, AlwaysUp never keeps, tracks or transmits your Windows password after it creates (or updates) a service.<\/p>\n

Instead, AlwaysUp hands your password to the Windows Services layer (via the CreateService<\/a> or ChangeServiceConfig<\/a> API functions), which stores the password securely. In that way, your password is handled just as safely as it is with the trusted operating system tools, like the Services<\/a> application.<\/p>\n

Specifically, the Service Control Manager — which launches and initializes services — stores the password with LsaStorePrivateData<\/a>. And when it’s ready to start a service, the SCM calls LsaRetrievePrivateData<\/a> to retrieve the service’s password. After the initial creation, AlwaysUp is simply not involved.<\/p>\n

\n
\n
\"\"<\/a><\/div>\n<\/div>\n

AlwaysUp doesn’t include your password when you export<\/h2>\n

As another important security measure, AlwaysUp does not (actually, cannot) include your Windows password when you export your application to an XML file. Instead, you will see ENTER A PASSWORD<\/b> in the password field:<\/p>\n

\"AlwaysUp<\/a><\/div>\n

Because AlwaysUp saves a placeholder instead of your password, you’ll have to re-enter your password when you import the XML file. However our team thought that was a small inconvenience to avoid leaking a sensitive password.<\/p>\n

\n
\n\n\n\n
More articles about AlwaysUp…<\/span><\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

You may also like...<\/h3>
<\/div>
<\/div>
\"OneDrive

OneDrive Version 23.48: Trouble Running in Session 0 [RESOLVED]<\/h3><\/div><\/div><\/a>
\"Q

Q & A: Why does Dropbox Stop Syncing my Files?<\/h3><\/div><\/div><\/a>
\"AlwaysUp

AlwaysUp not Starting your Application? Troubleshoot with the Command Prompt<\/h3><\/div><\/div><\/a><\/div>
<\/div><\/div><\/div>","protected":false},"excerpt":{"rendered":"

  I was looking to use AlwaysUp to run Excel as a service, and it looks like you can specify an account. How is the password stored when specifying an account? I want to make sure it\u2019s stored securely. — Ben … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":10582,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[26,259,256,143],"class_list":["post-10531","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-alwaysup","tag-alwaysup-tag","tag-excel","tag-passwords","tag-security"],"_links":{"self":[{"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/posts\/10531","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/comments?post=10531"}],"version-history":[{"count":29,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/posts\/10531\/revisions"}],"predecessor-version":[{"id":13781,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/posts\/10531\/revisions\/13781"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/media\/10582"}],"wp:attachment":[{"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/media?parent=10531"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/categories?post=10531"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/tags?post=10531"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}