```plaintext
The password for Century13 is the description of the computer designated as a Domain Controller within this domain **PLUS** the name of the file on the desktop.
**NOTE:**
– The password will be lowercase no matter how it appears on the screen.
– If the description “today_is” and the file on the desktop is named “_cool”, the password would be “today_is_cool”.
```
---
First, let's enumerate the Domain Controller
```powershell
PS C:\users\century12\desktop> Get-ADDomainController
ComputerObjectDN : CN=UTW,OU=Domain Controllers,DC=underthewire,DC=tech
DefaultPartition : DC=underthewire,DC=tech
Domain : underthewire.tech
Enabled : True
Forest : underthewire.tech
HostName : utw.underthewire.tech
InvocationId : 09ee1897-2210-4ac9-989d-e19b4241e9c6
IPv4Address : 192.99.167.156
IPv6Address :
IsGlobalCatalog : True
IsReadOnly : False
LdapPort : 389
Name : UTW
NTDSSettingsObjectDN : CN=NTDS
Settings,CN=UTW,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=underthewire,DC=tech
OperatingSystem : Windows Server 2016 Standard
OperatingSystemHotfix :
OperatingSystemServicePack :
OperatingSystemVersion : 10.0 (14393)
OperationMasterRoles : {SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster...}
Partitions : {DC=ForestDnsZones,DC=underthewire,DC=tech, DC=DomainDnsZones,DC=underthewire,DC=tech,
CN=Schema,CN=Configuration,DC=underthewire,DC=tech, CN=Configuration,DC=underthewire,DC=tech...}
ServerObjectDN : CN=UTW,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=underthewire,DC=tech
ServerObjectGuid : df17c8a3-dd76-438b-8ddf-b7ad3e624618
Site : Default-First-Site-Name
SslPort : 636
```
We found the name of the DC is `UTW`, so I looked up the AD Computer. However it doesn't include `Description` property.
```powershell
PS C:\users\century12\desktop> Get-ADComputer UTW
DistinguishedName : CN=UTW,OU=Domain Controllers,DC=underthewire,DC=tech
DNSHostName : utw.underthewire.tech
Enabled : True
Name : UTW
ObjectClass : computer
ObjectGUID : 5ca56844-bb73-4234-ac85-eed2d0d01a2e
SamAccountName : UTW$
SID : S-1-5-21-758131494-606461608-3556270690-1000
UserPrincipalName :
```
I listed all of the properties with the command `Get-ADComputer UTW -Property *` and I confirmed `Description` property exists.
Then I searched for description again, and I got `i_authenticate`
```powershell
PS C:\users\century12\desktop> Get-ADComputer UTW -Property Description
Description : i_authenticate
DistinguishedName : CN=UTW,OU=Domain Controllers,DC=underthewire,DC=tech
DNSHostName : utw.underthewire.tech
Enabled : True
Name : UTW
ObjectClass : computer
ObjectGUID : 5ca56844-bb73-4234-ac85-eed2d0d01a2e
SamAccountName : UTW$
SID : S-1-5-21-758131494-606461608-3556270690-1000
UserPrincipalName :
```
The filename on the desktop is `_things`
```powershell
PS C:\users\century12\desktop> ls
Directory: C:\users\century12\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:34 AM 30 _things
```
The password for [[Century13]] is `i_authenticate_things`