Hostnames with user "Administrator" saved in Windows Credential Manager

We are trying to build a query to get a list of host names that have a user named Administrator in their Windows Credential Manager. We found something close that looks like it is going through the event logs looking for any time something was read from the credential manager but not one that actually returns back what the stored credentials are.

I appreciate any insight into building this query that the community can provide.

ljohnson

Parents

JeramyKopacko over 2 years ago

Hi ljohnson

Thanks for posting in the LD&R Forum!

Allow me time to review this level of detail required to discover and write the query. If you have any information relevant in the event logs or reg key, please share. You can PM me if its easier as well.

-jk
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel

Comment

JeramyKopacko over 2 years ago

Hi ljohnson

Thanks for posting in the LD&R Forum!

Allow me time to review this level of detail required to discover and write the query. If you have any information relevant in the event logs or reg key, please share. You can PM me if its easier as well.

-jk
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel

Children

No Data