Making Windows Passwords Stealable
Starting with 8.x and 10, by default, there is no password in memory.
Exceptions:
When DC is/are unreachable, the kerberos provider keeps passwords for future negocation ; When HKEY_LOCAL_MACHINE, UseLogonCredential (DWORD) is set to 1, the wdigest provider keeps passwords ; When values in Allow* in HKEY_LOCAL_MACHINEor HKEY_LOCAL_MACHINE, the tspkgs / CredSSP provider keeps passwords.
(from https://github.com/gentilkiwi/mimikatz/issues/40#issuecomment-220830921)
You can edit the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest registry key as follows:
- change negotiate to 1
- add UseLogonCredential DWORD 1
The password will show up in mimikatz et al. after the next logon.