1

How do I decrypt user passwords that are encrypted and used in Windows 7 Sysprep unattend.xml file?

What Encryption method is used in this file?

Improve this question

1 Answer 1

Reset to default
3

It is a base64-encoded string. The way to make the original password visible is to unencode (decode) it. You can do this with a PowerShell script like this:

$encryptedpassword = "SQBKAHMALgBiAGwAbwBlAG0AMwBQAGEAcwBzAHcAbwByAGQA"
Write-Host [system.text.encoding]::Unicode.GetString([system.convert]::Frombase64string($encryptedpassword))

or use online base64 decoder like this: https://www.base64decode.org/

Improve this answer
2
  • After you decode, get rid of Password at the end.
    – E.V.I.L.
    Sep 20, 2017 at 18:53
  • Nice snippet! There was a () missing somewhere, this worked for me: $encryptedpassword = "SQBKAHMALgBiAGwAbwBlAG0AMwBQAGEAcwBzAHcAbwByAGQA" $dPwD= ([system.text.encoding]::Unicode.GetString([system.convert]::Frombase64string($encryptedpassword)));write-host $dPwD.Substring(0,($dPwD.length-8))
    – Shermansen
    Feb 13, 2018 at 9:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .