I have a very specific question. I'm in the middle of an assignment for school and my team is stuck at a part where we need to recover a password from the Event Logs that was purposely placed in there. He said there should be logs that have the password included in them that were man-made but we have no idea where to look. We've looked through the 4688, 4723, 4724 event logs, as well as the rest of them even though they don't apply much to this situation, to see if maybe there is custom information that's placed that includes a password but we can't find anything. There are logs where we can see that users were made and changes were made to their accounts/passwords and then one user was disabled and deleted but is there a way to actually get more information from an event log using PowerShell? We've been using MyEventViewer for the event logs but are really lost at this point. Our teacher said that he was able to get the password by using PowerShell. Does anyone have any idea as to how we could go about getting the password for a user like that going through PowerShell? It's the Domain Admin accounts password that we're looking for and it's also the same password for a KeePass database file that we need to unlock and then perform a live response after. Even if anyone knew how you can input your password into an event log, that would also really help so we can backtrack to see about exporting it. Any information would be greatly appreciated, thanks!
How to find a password that was purposely recorded in Event Logs with PowerShell?
957 Views Asked by Pacman12312 At
0
There are 0 best solutions below
Related Questions in POWERSHELL
- How to ignore warning errors?
- Data execution plan ended with error on DB restore
- Powershell Split a file name
- PowerShell EWS Save as for e-mails
- Run SQL Server Update Statement With Powershell
- using a global variable in multiple functions powershell
- Heisenberg was here: Aliases for PowerShell parameters only appear in cmdlet help when you do NOT document the cmdlet
- PowerShell Script to add newuser
- Why is PowerShell "not recognized" when installing Chocolatey?
- Enumerate a PSCustomObject as key/value pairs
- Unable to start program outside Windows folder
- Ask for creds only if some specified
- PowerShell 3 Parameters
- i can't ping a computer but remoting into it works (powershell enter-pssession)
- Feeding Variables in new-aduser -path option in powershell
Related Questions in EVENT-LOG
- Windows Service "Service could not be started" from EventLog call
- Failed to read logs from event logs with C# in Azure Windows Server 2012
- How often should I write to the Event Log in Windows?
- Read Event log file from path
- EvtSubscribe doesn't work with query on EventRecordID
- Export Event Log (.evtx) without "run as administrator"
- Why does NLog always write to Application event log instead of my own Custom log?
- How to Fetch the new event log from the previous event id
- How to compile manifest file with MC.exe?
- How can I find the index value of the last item in the Application EventLog? (As it doesn't seem to be Entries.Count - 1)
- eventlog source - string/message table lookup failed
- How can one query the Cluster .etl logs thru Powershell?
- Data type of a Keyword attribute in an XML event log
- The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security
- Create event log entry with powershell and fill in user
Related Questions in PASSWORD-ENCRYPTION
- WildFly datasource password protection
- Set encrypted postgres password without entering it as SQL
- Encrypting Passwords so devs do not have access to the key
- Code fails for decrypting without salt or iv in Java
- How to store password used for web scraping?
- Website Protection- Am i doing it right?
- Secure two way hashing technique
- password_verify not matching passwords
- encryption in spring-cloud-config-server
- Securing Plain Text Passwords in wso2is-5.2.0
- How to convert password from md5 to laravel encryption method
- Forgot my password for secure database
- Password protected page
- I'm not understanding the password_hash() function
- What is the Security Risk of Giving Away Both the Salt and Encrypted Password?
Related Questions in KEEPASS
- cmd /C set variable
- KeePass API to Access Currently Open Database from Code
- Keepass and libkeepass on windows?
- Ubuntu 15.10: Copy password from keepass2 to PhpStorm
- Add additional attribute to keepass record in python
- Shorten URL's in KeePass-DB
- Bash script using Expect working fine locally but fails in a gitlab-ci job
- Use KEE PASS in Powershell Script to pass Username and Password
- How to create kdbx file in python
- kdbxweb usage for creating dbs, storing and retrieving passwords for use in scripts/jobs
- keepassX autotype turns @ into 1/8
- How can I merge keepass database stored in mercurial repository?
- Open SQL Developer from command line with parameters (connectstring, user, passwort...)
- Keepass auto-type perform auto-type {USERNAME}{ENTER}
- Chrome crash: Attempt to invoke virtual method "long android.view.accessibility.AccessibilityNodeInfo.getSourceNodeId()" on a null object reference
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?