# Saved Auto-Logon Credentials After booting, servers and systems are locked until a user manually enters the login credentials. In the case of a misconfigured or testing system, the credentials for auto-logon might be saved. If this is the case, they can be found under `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon`. You might want to check `DefaultPassword` if saved and `AutoAdminLogon`if set to 1. - Default Password - Default Username ```powershell reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v keyword reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUsername # Installed Applications reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall # Services reg query HKLM\SYSTEM\CurrentControlSet\Services reg query HKLM\SYSTEM\CurrentControlSet\Services | ForEach-Object { $_.split("\")[4] } | ForEach-Object { sc.exe qc $_ } | findstr /i "SERVICE_NAME BINARY_PATH_NAME DISPLAY_NAME SERVICE_START_NAME" # Seraching the registry reg query HKLM /f "password" /t REG_SZ /s ```