dpapi.keyprovider.defaultpassword.winlogon.keys

$ target-query <path/to/target> -f dpapi.keyprovider.defaultpassword.winlogon.keys

Details

Module	dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.winlogon.WinlogonDefaultPasswordKeyProviderPlugin
Output	lines

Module documentation

Windows Winlogon DefaultPassword key provider plugin.

Function documentation

Yield Windows Winlogon DefaultPassword strings.

Extracts plaintext DefaultPassword values from the Winlogon registry.

References:

• https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon