Auditing Windows Clipboard History and Cloud Clipboard: The Sync Feature That Leaks Secrets

Everyone copies secrets. You paste a database password out of your vault, copy an API token from the portal, grab a recovery code during an MFA reset. You assume the clipboard is a volatile, in-memory buffer that gets overwritten by the next copy. Since Windows 10 build 1809, that assumption is wrong. Clipboard History keeps the last 25 items in a persistent ring buffer, and Cloud Clipboard can sync those items through your Microsoft account to every other machine you own. For an attacker who lands on an endpoint, that is a pre-collected trove of credentials sitting one keystroke — Win+V — away.

What actually gets retained

Two independent features are at play, and they are controlled separately:

• Clipboard History (EnableClipboardHistory): a local, per-user history of up to 25 recent clips — text, HTML, and small bitmaps. Survives app switches and, for pinned items, reboots.
• Cloud Clipboard / clipboard sync (CloudClipboardAutomaticUpload): pushes clipboard contents to Microsoft's roaming service so they appear on your other Windows devices and in some Microsoft 365 contexts.

The security problem is that neither feature distinguishes a shopping list from a domain admin password. Password managers can set the ExcludeClipboardContentFromMonitorProcessing / CanIncludeInClipboardHistory clipboard format to opt a clip out, but most apps — RDP, terminals, browsers pasting into dev tools — do not. Anything those apps copy is fair game for the history.

Why it matters to an attacker

Credential theft is usually loud: touching LSASS, reading the SAM, or scraping DPAPI blobs all generate telemetry and trip modern defenses. Clipboard history is the opposite — it is a sanctioned user feature with no special permissions required to read it. A low-privilege process running as the logged-in user can enumerate the history and, if sync is on, correlate it with items copied on a totally different machine.

The clipboard is the one place where a user voluntarily moves their highest-value secrets in plaintext, repeatedly, all day. Persisting that is a gift to anyone who gets code execution as that user.

This maps cleanly to MITRE ATT&CK T1115 (Clipboard Data) and, when sync is enabled, to data staged in a cloud service the defender may not even be monitoring.

Auditing the configuration

The settings live in both policy and per-user hives. Check the effective state rather than trusting the Settings UI:

# Machine-wide policy (overrides user choice when set)
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v AllowClipboardHistory
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v AllowCrossDeviceClipboard

# Per-user current state
reg query "HKCU\Software\Microsoft\Clipboard" /v EnableClipboardHistory
reg query "HKCU\Software\Microsoft\Clipboard" /v CloudClipboardAutomaticUpload

A value of 0 for the two Allow* policies is the hardened state: it disables the feature for every user and greys it out in Settings so it cannot be re-enabled locally. If the policy keys are absent, the feature falls back to the user's choice — which defaults to history being usable via Win+V.

Hardening it

For most managed fleets, both features should be off. Set them by policy so the decision is enforced, not advisory:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v AllowClipboardHistory /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v AllowCrossDeviceClipboard /t REG_DWORD /d 0 /f

The equivalent GPO path is Computer Configuration → Administrative Templates → System → OS Policies → "Allow Clipboard History" and "Allow Clipboard synchronization across devices", both set to Disabled. On Intune, use the Policy CSP settings AllowClipboardHistory and AllowCrossDeviceClipboard.

If a team genuinely needs local history for productivity, at minimum kill cross-device sync — that is the setting that turns a single-machine exposure into a cloud-staged one. And make sure your password manager marks its clips as non-historical; test it by copying a vault entry and checking whether it shows up in Win+V.

Where WinSentinel fits

WinSentinel audits the clipboard surface as part of its data-exposure checks: it reads the effective policy and per-user state, flags when history or cross-device sync is enabled on a machine that handles secrets, and explains the exact remediation keys above. On a single machine, WinSentinel Free gives you the full check — all 64 modules, no limits — so any admin can scan their own workstation and close the gap in minutes.

Across an organization, the same finding becomes a fleet problem: one re-imaged laptop with sync flipped back on re-opens the hole. WinSentinel Pro rolls this check up across every node, so a compliance team sees at a glance which machines still have Cloud Clipboard enabled, gets a drift alert the moment one regresses, and can confirm the policy is enforced fleet-wide rather than hoping each user left it alone. The clipboard is a small setting with an outsized blast radius — worth auditing everywhere secrets are typed.