#2413 AutoType not working on Windows Secure Desktop after Windows update (KB5074109)

[Björn Martin]

Since installing the Microsoft security update mentioned in the title on our network, the autotype appears, but when we click to choose a password, nothing is entered. (Bug in the "Windows Security" window when opening an RDP session)

I tried it with RDP-Connections aswell as Network Shares, the credentials will not be entered. Works fine for anything else.

KeePass Version: 2.60

On another Workstation without the KB in the title, everything works fine.

[Jens Dilger]

same here.
Two-Channel Auto-Type Obfuscation doesn't make a difference.
Manual Copy&Paste from KeePass to the Window with STRG+V works.

[Björn Martin]

I uninstalled "Update for Windows Security platform - KB5007651 (Version 10.0.29429.1000)"
and then it works again.

I believe this Update is part of the "2026-01 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5074109) (26100.7623)"

[Dominik Reichl]

I can reproduce this issue and have experimented with it. The new Windows Security credentials dialog blocks other applications running with normal user rights (such that auto-type doesn't work, drag&drop doesn't work, accessibility tools cannot inspect the dialog, etc.). I don't see how KeePass could get around that with normal user rights.

You could do the following:

• Run KeePass as administrator. Auto-Type then works.
• Alternatively, use the clipboard instead (i.e. look for an entry in KeePass, copy the password of the entry to the clipboard and paste it in the credentials dialog). This is less convenient, but works without administrative privileges.

As this is probably an intended security improvement by Microsoft (i.e. not a bug that will be fixed) and affects many users, I've now added the Windows Security credentials dialog as an example in the 'Rights' section of the auto-type help page:
https://keepass.info/help/base/autotype.html#req

Thanks and best regards,
Dominik

[Roman]

Thank you for mentioning workaround with "Run As Admin".
Is it possible to run KeePass with admin privileges by default?

[Dominik Reichl]

You could create a shortcut to 'KeePass.exe' and activate the option 'Run as administrator' (in the shortcut properties → tab 'Shortcut' → button 'Advanced').

Best regards,
Dominik

[Björn Martin]

I can't get it to work when running KeePass as an administrator, either. Any idea?

[Jens Dilger]

Thanks for reviewing the problem. May I suggest a workaround: a small extra Service, that is installed extra (or "activated" with admin rights) and runs under SYSTEM. KeePass can communicate with the Service/Tool/Plugin which handles the Auto-Type. So the Program doesn't need to get started as Admin, which is not an option for many users.
This Option could be a third optional Auto-Type-Option, just like "Two-Channel Auto-Type Obfuscation".
You'd only need to ensure, that the tool only receives commands from KeePass somehow. Maybe an key password, which is created during install of the tool and has to be inserted in a database-options field in the KeePass-DB. And then use the key as encryption and signature for the communication.
What do you think?

[Paul]

Great idea. Are you going to write it?

cheers, Paul

[Dominik Reichl]

In my opinion, such a service would be a significant security risk.

I'm not planning to add this in KeePass, but if someone develops a plugin, I'll happily list it on the plugins page.

Best regards,
Dominik

[Arnaud Durand]

Hello.
I confirm the same issue since the Windows 11 update KB5073455 (January cumulative update).
Running KeePass as administrator is indeed a good workaround for this issue, which only impacts Windows UAC.

[Andre Steden]

Hello Dominik,

I have an application that fills the username and password fields of the Windows RDP dialog using UI Automation. After the Microsoft patch, my application stopped working as well.

It only started working again after I added a manifest to my application with the following entry:

<requestedExecutionLevel level="asInvoker" uiAccess="true" />

The uiAccess="true" flag is crucial here.

It is also important that the EXE file is located under C:\Program Files\ or C:\Program Files (x86)\, and that the EXE has a valid digital signature.

Maybe this could be an option for KeePass?

[Dominik Reichl]

See https://sourceforge.net/p/keepass/feature-requests/2964/.

Best regards,
Dominik