5

I was wondering what Windows/Linux/Live tools allow to retrieve user password hashes of modern 2021 Win10/11 installations. I am not sure if password storage differs in these cases (e.g. different location or hash in use) from previous Windows versions (NT hash stored in SAM):

  • Microsoft account logged in during installation with account password/Windows Hello access
  • Local user created during installation with password and mandatory hint/security questions
  • Local user initially created without password, and then added password via Control Panel (no hint/security questions required)
  • other setups if any
Improve this question
2
  • Mimikatz did, at least for Windows 10 local accounts. I haven't tested it on Win11, but it should work. I don't know about Microsoft accounts, but I expect it works for them too.
    – nobody
    Commented May 15, 2022 at 15:47
  • LaZagne can retreive many passwords stored somewhere in Windows (including User PWs), but it needs to be whitelisted on Windows Defender
    – UndercoverDog
    Commented Sep 12, 2022 at 16:54

1 Answer 1

Reset to default
2

LaZagne can recover all kinds of passwords and password hashes stored in Windows, including browsers, programs (like Skype, Thunderbird etc.), WiFi passwords, Windows user password hashes and more.

In order to retreive all windows passwords, just open a shell with admin priviligies and type LaZagne.exe [module(s)] to retreive all passwords that the module includes. So in your case LaZagne.exe Windows to retreive all Windows (user) password hashes.

Table of all modules and passwords that can be recovered (Source): [Modules]

This tool works in Windows 10 and should work in Windows 11 aswell, since both operating systems are very similar.

The only disadvantage is that it needs to be manually whitelisted on Windows Defender.

Improve this answer
3
  • Only a local user account with single password, getting this: imgur.com/a/qcXEXNa
    – Polizi8
    Commented Sep 13, 2022 at 9:41
  • The Screenshot is really blurry, but I guess it shows besides your name sth like Administrator [hash] and Guest [hash]. This is normal, although Im not sure what that means, but I guess that These are just hashes of an empty password/No password
    – UndercoverDog
    Commented Sep 13, 2022 at 12:59
  • The Administrator account is probably deactivated by Standard in the home Version of Windows and only used by companies etc. The guest Account is deactivated aswell and can/could be activated in the settings (only tried it in Windows 7 some years ago)
    – UndercoverDog
    Commented Sep 13, 2022 at 15:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .