Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm doing some testing with DPAPI for a project where I'm involved. I would like to know where the users Masterkey are located and if there is any free utility to find and decipher them.

I'm pretty sure that they are located in "%APPDATA%\Microsoft\Protect\" subfolders, but as far as free utilities goes, the only one I've found is DPAPIck, but is outdated and it doesn't seem to work properly in my system (Windows 2008 Server R2, I'm using the 0.1 version because I don't have any python interpreter installed).

share|improve this question
    
Here is information on the DPAPI keys and C# code to work with them: security.stackexchange.com/q/1771/396 –  makerofthings7 Oct 15 '12 at 14:06
add comment

1 Answer

up vote 1 down vote accepted

The key blobs are stored in the following path:

%APPDATA%\Microsoft\Protect\{SID}

Where {SID} is the security identifier for the user.

There's a paid tool by PassWare that claims to support Win2K8, but it looks like DPAPick is the only freeware tool. Since it's a community project, you could always drop them a bug report. You also mentioned that you aren't running the latest version due to not having python... just go grab python then!

share|improve this answer
    
Thanks, I've already seen the PassWare software, I can't try it from my PC at work due to limitations, I'll try it at home. (maybe I'll get it for free by translating it in Italian) –  Fabio Oct 15 '12 at 14:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.