So the short answer is no.   TL;DR;   The concern I'm trying to address is the ability for someone in a privileged position to impersonate someone else without them realizing it.   As for extracting password hashes, I'm surprised that Microsoft hasn't implemented a better hashing algorithm that would require more time to brute force the hash.   Regarding Wi-Fi, I see several challenge-response pairs and was assuming the mechanism was using an authentication method that didn't require sending the password.  Example: the server sends a random string, the client then responds with a hash resulting from the combination of the hashed password and the random string - by doing this multiple times the server can be sure that the client knows the password without actually sending the password.   Of course, depending on how much access the admin has, they can enable reversible encryption and install key loggers.  No solution is perfect, but I'm trying to limit an attacker's options - regardless of if they are foreign or domestic.  If a password gets changed, it's recognized right away.  The other issue is that most users re-use passwords and could gain access to systems beyond the original scope of the attacker. ... View more