DefaultPassword Dumper

21 May

Just a small post today: a small commandline utility that reads the “DefaultPassword” LSA secret.

This secret is stored in the registry under the SECURITY Hive:

$HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\DefaultPassword$

It’s data is encrypted but can be read using the LsaRetrievePrivateData API.

~~It’s meaning is not documented but the value is often the Windows account password but not always 😀~~

EDIT: as Andrew Morgan commented the DefaultPassword key is of course the encrypted version of the Autologon password as set by for example the SysInternals Autologon tool. I really should have known that…

DefaultPassword.zip (1826 downloads)

Please consider donating something (even a small amount is ok) to support this site and my work:

Filed under: Windows Internals

7 Responses for "DefaultPassword Dumper"

Andrew Morgan May 21st, 2012 at 23:09 1
Interesting one Remko,
the key you describe here is used by autologon (from sys internals) when you configure an autologon account.
this must correspond with the autologon options in HKLM\software\Microsoft\WindowsNT\currentversion\WinLogon
Ingmar Verheij May 22nd, 2012 at 8:31 2
When the application is executed unprivileged it returns “OpenPolicy failed with 0xC0000022 (Access denied)”. Mayb you can force it to run privileged?
It didn’t show anything on my machine. That’s probably because I don’t use autologon from sysinternals as Andrew described.
Andrew Morgan May 22nd, 2012 at 8:43 3
Ingmar, it was just pure fluke I stumbled across it while I was testing on a ThinKiosk box. Another case of me and Remko working on the same thing at the same time!
I’m not sure you can force a UAC prompt on a console app either.
Remko May 22nd, 2012 at 9:38 4
As @KeesBaggerman guessed this is an old project, I didn’t know at that time what the value meant but I should have known (now) that this was the Autologon Password!
Remko May 22nd, 2012 at 9:38 5
I will try to add a manifest that requires admin privileges…
Remko May 22nd, 2012 at 9:38 6
This is getting scary Andrew 😀
xpclient May 24th, 2012 at 7:17 7
For some reason my last comment didn’t appear. You can use the tool LogonExpert to use autologon and store the password in a secure AES encrypted location.