jueves, 21 de diciembre de 2023

Remove credentials from SYSTEM context via credential manager

  1. Download PsExec and copy to %WINDIR%\system32
  2. run: rundll32 keymgr.dll,KRShowKeyMgr
Remove items.

Related to EventID 14 

Log Name:      System
Source:        Microsoft-Windows-Security-Kerberos
...
Event ID:      14
....
Description:
The password stored in Credential Manager is invalid. This might be caused by the user changing the password from this computer or a different computer. To resolve this error, open Credential Manager in Control Panel, and reenter the password for the credential Email removed for privacy.
...

No hay comentarios:

Publicar un comentario

L2TP Ipsec Windows to Mikrotik eror 789

 Add this to registry REG ADD HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent /v AssumeUDPEncapsulationContextOnSendRule /t REG_DWORD /d...