winlogon.winlogon

$ target-query <path/to/target> -f winlogon.winlogon

Details

Module	dissect.target.plugins.os.windows.credential.winlogon.WinlogonPlugin
Output	records

Module documentation

Windows Winlogon plugin.

Function documentation

Yield Windows Winlogon DefaultPassword strings.

Extracts plaintext DefaultPassword values from the Winlogon registry.

References:

• https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon