[kristijan97]

Hello,

I'm in domain and have access to normal domain user which have local admin privilegies on my PC. Another domain user can login on my PC whether my PC is on domain network or not but he must login at least once on my PC when my PC was on domain network.

So, his password is stored somewhere on my PC because he can login on his account even my PC is not on domain network.

Can I get his password in plain text if I have local admin privilegies on my PC?

[doggo]

You could try using mimikatz, run it as admin, run the commands:

# privilege :: debug
# sekurlsa :: logonPasswords full

You might require the user to have an open session at the same endpoint.

[kristijan97]

Thanks! Mimikatz works great when user has open session, but mimikatz cannot extract password from logouted user

---

Is there any way to do the same thing, but on logouted user?