defaultpassword.defaultpassword

$ target-query <path/to/target> -f defaultpassword.defaultpassword

Details

Module	dissect.target.plugins.os.windows.credential.defaultpassword.DefaultPasswordPlugin
Output	records

Module documentation

Windows LSA DefaultPassword plugin.

Function documentation

Yield decrypted Windows LSA DefaultPassword records.

Extracts decrypted DefaultPassword values from the LSA.

References:

• https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon