On Windows hosts where WDigest is available, setting UseLogonCredential=1 configures the WDigest provider to retain credentials in LSASS memory. Windows 8.1 and Windows Server 2012 R2 and later default this value to 0 when it is absent. Recoverable plaintext depends on an applicable WDigest authentication and the host's credential protections; changing the registry alone does not prove a password was cached. An authorized operator with LSASS access can inspect provider data with Mimikatz.
Variant:
Collect Windows secrets
powershell
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER