Get-NTLMLocalPasswordHashes

NAME Get-NTLMLocalPasswordHashes



SYNOPSIS

Extract local NTLM password hashes.





SYNTAX

Get-NTLMLocalPasswordHashes [<CommonParameters>]





DESCRIPTION

Extract all local NTLM user password hashes from the registry handling latest

AES-128-CBC with IV obfuscation techniques introduced with Windows 10 1607 as

well as the traditional MD5/RC4 approach used in Windows 7/8/8.1.





PARAMETERS

<CommonParameters>

This cmdlet supports the common parameters: Verbose, Debug,

ErrorAction, ErrorVariable, WarningAction, WarningVariable,

OutBuffer, PipelineVariable, and OutVariable. For more information, see

about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).



INPUTS



OUTPUTS

System.Management.Automation.PSObject





NOTES





Requires to be run as SYSTEM.



-------------------------- EXAMPLE 1 --------------------------



PS C:\\>Get-NTLMLocalPasswordHashes















RELATED LINKS