Under Review

Hostnames with user "Administrator" saved in Windows Credential Manager

We are trying to build a query to get a list of host names that have a user named Administrator in their Windows Credential Manager. We found something close that looks like it is going through the event logs looking for any time something was read from the credential manager but not one that actually returns back what the stored credentials are.

I appreciate any insight into building this query that the community can provide.

Parents Comment Children
No Data