> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-6/credential-recovery/separate-service/information-gathering-credential-recovery-windows.md).

# Windows

## Credential Discovery Winlogon Registry Autologon

On Windows systems configured for automatic user logon, credentials might be stored in cleartext within the registry.

Check the `HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon` key for potential cleartext credentials. This can be done using the `reg query` command:

```bash
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"
```

Alternatively, PowerShell can be used to retrieve the properties of the key:

```powershell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"
```

A more targeted PowerShell command can specifically retrieve the values relevant to autologon:

```powershell
Get-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' | Format-List DefaultUserName,DefaultPassword,AutoAdminLogon
```

When examining the output, look for the values `AutoAdminLogon`, `DefaultUserName`, and `DefaultPassword`. The `AutoAdminLogon` value indicates if autologon is enabled; it should be set to `1` if so. If `AutoAdminLogon` is set to 1, `DefaultUserName` is configured, and `DefaultPassword` exists and is not empty, then the password for that user is stored in cleartext in this registry location. The `DefaultPassword` registry value stores the password in cleartext when automatic logon is enabled. This requires sufficient permissions to read the HKLM hive, typically user-level or higher. This method of storing passwords in cleartext represents a security risk, as the password can be easily retrieved by anyone with appropriate registry read permissions on the system.