Obtain accessible live logon-session credential material

Needs: Required process/host privileges, useful sessions and compatible architecture; PPL/Credential Guard/protection may prevent access or remove material

Windows commands

Source What it can contain Typical prerequisite Result is not automatically
Current ticket cache TGTs and service tickets for the current logon session Current user; other LUIDs normally require elevation A password, NT hash or authorization to every service
LSASS memory/dump Logon-session NTLM/AES/DPAPI material and tickets, depending on OS/protection/logon type Administrator/SYSTEM, suitable debug/dump access, compatible architecture Guaranteed cleartext or every user's reusable secret
SAM + SYSTEM Local account password hashes Administrator/SYSTEM/backup-capable access to matched hives Domain-account material
SECURITY + SYSTEM LSA secrets, service/machine secrets, cached domain verifiers Administrator/SYSTEM/backup-capable access to matched hives Directly passable cached-domain hashes
Credential Manager/DPAPI Targeted saved credentials and protected application data Suitable user/machine context plus master-key material Plaintext merely because a blob/file is readable
NTDS + SYSTEM Domain account hashes/keys from a DC database DC-level file access and matched boot-key material Ordinary member-server admin access
DRS replication Selected domain-account secrets Effective replication rights at the domain root Local admin, DC service access or Domain Users membership

REM Baseline
whoami /all
tasklist /fi "imagename eq lsass.exe"
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags

PowerShell commands

# Baseline
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
  Select-Object SecurityServicesConfigured,SecurityServicesRunning,VirtualizationBasedSecurityStatus

membership in Administrators with a medium-integrity filtered token is not equivalent to an elevated process;

SeDebugPrivilege must be present and usable for common live-process access;

a missing registry value is not definitive proof that a protection is disabled because defaults, policy and firmware state matter;

LSA protection blocks untrusted code injection/process-memory access; Credential Guard isolates selected NTLM, Kerberos and saved-domain secrets with VBS;

EDR/AV can block a tool or dump path without proving the underlying credential source is empty.

An access-denied or empty result disproves only that method in the current context.

Direct Mimikatz access

# Direct Mimikatz access
mimikatz.exe
privilege::debug
sekurlsa::logonpasswords
sekurlsa::tickets

Dump first, parse offline

REM Dump first, parse offline
for /f "tokens=2" %A in ('tasklist ^| findstr /i lsass.exe') do rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump %A C:\Windows\Temp\lsass.dmp full

REM Sysinternals ProcDump alternative
procdump64.exe -accepteula -ma lsass.exe C:\Windows\Temp\lsass.dmp

Parse with a compatible Mimikatz build

# Parse with a compatible Mimikatz build
mimikatz.exe
sekurlsa::minidump C:\Path\To\lsass.dmp
sekurlsa::logonpasswords
sekurlsa::tickets

Dump first, parse offline

dump creation denied: token/protection/EDR or process-access prerequisite failed;

ProcessorArchitecture mismatch: use compatible x64/x86 tooling;

OS major-version mismatch: parse with a compatible build/environment;

dump succeeds but secrets are absent: logon type, sign-out/reboot, Credential Guard and provider behavior affect contents.

# Dump first, parse offline
Get-ComputerInfo | Select-Object DeviceGuardSecurityServicesConfigured,DeviceGuardSecurityServicesRunning

Credential Guard can isolate reusable domain secrets from ordinary LSASS memory. It does not erase local SAM, file, vault, DPAPI, ticket, service-configuration or directory-right paths. One failed dump method disproves only that method and context. Intrusive SSP interception changes system state and waits for a future logon; it is not the default Block 5 response.

Verify → Tie each artifact to an account, source/logon session and material type; independently validate any useful reuse.

If it fails → Protected process access denial, absent sessions and unsupported parsing are different outcomes. Prefer an accessible ticket or other matched source when available. More detail ↓

If → then

An NT verifier from an appropriate credential source → Recover or reuse an NT password hash
Needs: Correct account/domain and actual NT hash; recovery mode or an accepting NTLM service with required destination rights
A ccache/kirbi file or an existing ticket cache → Classify tickets and use a compatible cache
Needs: Correct principal/realm, valid lifetime, service scope, compatible cache format and naming/KDC route
Protected local registry material is available under sufficient host privilege → Extract local account hashes from matched SAM and SYSTEM
Needs: Matched SAM/SYSTEM from the same system and appropriate read/backup access
An already controlled DC or a validated privileged domain collection context → Parse an offline domain database or select a justified remote collection path
Needs: Matched NTDS/SYSTEM for offline parsing, or the specific remote protocol/host/replication rights required by the chosen method

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Obtain accessible live logon-session credential material

USE WHEN: A controlled Windows host may hold useful logged-on identities
STARTING ACCESS: A domain identity, appropriate host privilege, or a validated effective directory-object right
RESULT: Typed password/hash/key/ticket artifacts from accessible logon sessions

Recognize the clue

On the verified controlled host inspect current token, logged-on session evidence and protection configuration before choosing a credential source.

whoami /all
query user
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL

SYNTHETIC EXAMPLE OUTPUT

Current context: privileged host token
Session list: DOMAIN\USER may be present
RunAsPPL: enabled

Means: A useful session is a possible source, while PPL/protection can prevent the chosen process-memory access.

Confirm: Verify actual privilege, fresh useful sessions, process/architecture compatibility and protection; prefer accessible tickets when sufficient.

After validation: The authorized source is accessible and yields correctly classified material: follow its actual credential type.
Ruled out in this context: The required source is protected/unavailable to this context: reject that collection method.
Still inconclusive: A past graph session without fresh host evidence leaves useful live material unknown.

Troubleshooting: Protected process access denial, absent sessions and unsupported parsing are different outcomes. Prefer an accessible ticket or other matched source when available.

Source	What it can contain	Typical prerequisite	Result is not automatically
Current ticket cache	TGTs and service tickets for the current logon session	Current user; other LUIDs normally require elevation	A password, NT hash or authorization to every service
LSASS memory/dump	Logon-session NTLM/AES/DPAPI material and tickets, depending on OS/protection/logon type	Administrator/SYSTEM, suitable debug/dump access, compatible architecture	Guaranteed cleartext or every user's reusable secret
SAM + SYSTEM	Local account password hashes	Administrator/SYSTEM/backup-capable access to matched hives	Domain-account material
SECURITY + SYSTEM	LSA secrets, service/machine secrets, cached domain verifiers	Administrator/SYSTEM/backup-capable access to matched hives	Directly passable cached-domain hashes
Credential Manager/DPAPI	Targeted saved credentials and protected application data	Suitable user/machine context plus master-key material	Plaintext merely because a blob/file is readable
NTDS + SYSTEM	Domain account hashes/keys from a DC database	DC-level file access and matched boot-key material	Ordinary member-server admin access
DRS replication	Selected domain-account secrets	Effective replication rights at the domain root	Local admin, DC service access or Domain Users membership

Interpretation:

membership in Administrators with a medium-integrity filtered token is not equivalent to an elevated process;
SeDebugPrivilege must be present and usable for common live-process access;
a missing registry value is not definitive proof that a protection is disabled because defaults, policy and firmware state matter;
LSA protection blocks untrusted code injection/process-memory access; Credential Guard isolates selected NTLM, Kerberos and saved-domain secrets with VBS;
EDR/AV can block a tool or dump path without proving the underlying credential source is empty.

An access-denied or empty result disproves only that method in the current context.

Direct Mimikatz access

Decisive output is a named logon session with a typed value: NTLM, AES key, DPAPI key or ticket. A username with Password : (null) is not a failed tool run when another useful field exists, and modern Windows commonly does not retain reusable cleartext.

Dump first, parse offline

Built-in comsvcs.dll method from an elevated command prompt:

Sysinternals ProcDump alternative:

Parse with a compatible Mimikatz build:

Common failures:

dump creation denied: token/protection/EDR or process-access prerequisite failed;
ProcessorArchitecture mismatch: use compatible x64/x86 tooling;
OS major-version mismatch: parse with a compatible build/environment;
dump succeeds but secrets are absent: logon type, sign-out/reboot, Credential Guard and provider behavior affect contents.

LSASS dumps are sensitive and noisy. Hash the evidence if needed, transfer through the established route, store it privately and remove the target copy after the authorized objective.

Credential Guard can isolate reusable domain secrets from ordinary LSASS memory. It does not erase local SAM, file, vault, DPAPI, ticket, service-configuration or directory-right paths. One failed dump method disproves only that method and context. Intrusive SSP interception changes system state and waits for a future logon; it is not the default Block 5 response.

Why it works

LSASS material depends on logon type, authentication package, session lifetime and protection. Administrator membership alone does not guarantee readable credentials or plaintext passwords.

Worked example · hypothetical

Observation: a privileged user had a session on a controlled host. Test: validate current session and protection state before the appropriate collection method. Illustrative output: an NT hash is available but no plaintext password. Interpretation: classify it and select a compatible authorized service.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗