In the server registry with Windows CMA, the token is unencrypted.

In the case of a terminal server, the token is visible to all users, which is a problem.

Furthermore, it is stored in keys that are accessible to everyone.