dpapi.keyprovider.defaultpassword.lsa.keys

$ target-query <path/to/target> -f dpapi.keyprovider.defaultpassword.lsa.keys

Details

Module	dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa.LSADefaultPasswordKeyProviderPlugin
Output	lines

Module documentation

Windows LSA DefaultPassword key provider plugin.

Function documentation

Yield Windows LSA DefaultPassword decrypted strings.

Extracts decrypted DefaultPassword values from the LSA.

References:

• https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon