±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36595
New Yesterday: 4 Visitors: 126

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Search found 46 matches

Re: Windows 10 Virtualisation & Microsoft user accounts

Post Posted: Jan 30, 19 14:48

[quote="MrMacca"]I've been doing some experimentation with VM's and I've had about 90% success rate on systems that have a Microsoft account attached rather than a Local account.[/quote]
If you had V ...
Brevs11
Topic: Windows 10 Virtualisation & Microsoft user accounts
Replies: 14
Views: 5152
 

Re: Windows 10 Virtualisation & Microsoft user accounts

Post Posted: Jan 30, 19 12:49

[quote="randomaccess"]
Where does windows cache the passwords there?[/quote]
It seems as though only Microsoft and the person who wrote MimiKatz know Smile

The MimiKatz notes get really heavy but ...
Brevs11
Topic: Windows 10 Virtualisation & Microsoft user accounts
Replies: 14
Views: 5152
 

Re: Windows 10 Virtualisation & Microsoft user accounts

Post Posted: Jan 30, 19 08:03

I'm running the latest build of Windows 10, with a Microsoft account protected with a PIN. I removed the Ethernet cable rebooted and I could still login with the same PIN so it's cached locally somewh ...
Brevs11
Topic: Windows 10 Virtualisation & Microsoft user accounts
Replies: 14
Views: 5152
 

Re: Windows 10 Virtualisation & Microsoft user accounts

Post Posted: Jan 29, 19 11:57

[quote="randomaccess"]I'll have to think through the problem; the password is stored somewhere, just where I don't know yet.[/quote]

Many thanks for the info.

It makes you wonder how many people ...
Brevs11
Topic: Windows 10 Virtualisation & Microsoft user accounts
Replies: 14
Views: 5152
 

Re: Windows 10 Virtualisation & Microsoft user accounts

Post Posted: Jan 29, 19 07:52

[quote="mjpetersen"]The reason you are not seeing the account is because the passwords are not stored locally.

Have you tried the VFC Password Bypass? Did that work or did it only allow you to vie ...
Brevs11
Topic: Windows 10 Virtualisation & Microsoft user accounts
Replies: 14
Views: 5152
 

Re: Windows 10 Virtualisation & Microsoft user accounts

Post Posted: Jan 28, 19 11:15

AccessData Registry Viewer, ophcrack, IEF, EnCase v6 & v8 all show the NT hash and password as empty in the SAM.

I did another little bit of research a while back and I stand to be corrected but th ...
Brevs11
Topic: Windows 10 Virtualisation & Microsoft user accounts
Replies: 14
Views: 5152
 

Windows 10 Virtualisation & Microsoft user accounts

Post Posted: Jan 28, 19 10:09

Morning all.

I've been attempting for a while to find a way to login to a Microsoft user account on a Windows 10 computer when that computer has been virtualised (FTK Imager to mount the forensic i ...
Brevs11
Topic: Windows 10 Virtualisation & Microsoft user accounts
Replies: 14
Views: 5152
 
Page 1 of 7
Page 1, 2, 3, 4, 5, 6, 7  Next