> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/active-directory/credentials.md). # Credentials and Tokens Windows and Active Directory credential notes covering LSASS, SAM, MSCache, access tokens, impersonation tokens, LogonSessions, registry hives, and Mimikatz. Credential-focused Active Directory notes for Windows authentication, LSASS memory, SAM extraction, cached domain credentials, token analysis, and post-exploitation workflows.

:key:

Windows Authentication

Active Directory security notes for Authentication and authorization in Windows, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Authentication and authorization in Windows

:key:

Interactive Authentication

Active Directory security notes for Interactive authentication, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Interactive authentication

:key:

Non-Interactive Authentication

Active Directory security notes for Non-interactive authentication, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Non-interactive authentication

:key:

Logon Sessions

Active Directory security notes for Observing login sessions, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Observing login sessions

:key:

Access Token

Active Directory security notes for Access token, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Access token

:key:

Primary and Impersonation Tokens

Active Directory security notes for Primary and Impersonation Tokens, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Primary and Impersonation Tokens

:key:

Process Explorer Tokens

Active Directory security notes for Observing tokens with Process Explorer, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Observing tokens with Process Explorer

:key:

LSASS Credentials

Active Directory security notes for Access to in-memory credentials: LSASS, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Access to in-memory credentials: LSASS

:key:

LogonSessions

Active Directory security notes for Observing sessions with LogonSessions, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Observing sessions with LogonSessions

:key:

Local Privilege Example

Active Directory security notes for Local Privilege Example, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Local Privilege Example

:key:

LSASS and SAM Dumping

Active Directory security notes for Extraction of LSASS and SAM on Windows, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Extraction of LSASS and SAM on Windows

:key:

SAM Database Dump

Active Directory security notes for Extraction of the SAM database, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Extraction of the SAM database

:key:

SAM from Registry Files

Active Directory security notes for SAM extraction with registry files, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.SAM extraction with registry files

:key:

LSASS via Task Manager

Active Directory security notes for Extracting LSASS via Task Manager, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Extracting LSASS via Task Manager

:key:

Extraction from Linux

Active Directory security notes for Extracting from Linux, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Extracting from Linux

:key:

Cached Domain Credentials

Active Directory security notes for Cached domain credentials: MSCache, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Cached domain credentials: MSCache

:key:

MSCache with Mimikatz

Active Directory security notes for Extracting the credential cache with Mimikatz, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Extracting the credential cache with Mimikatz

:key:

MSCache from Registry Hives

Active Directory security notes for Extracting MSCache from registry hives, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Extracting MSCache from registry hives

:key:

SAM, LSASS, LSA, MSCache

Active Directory security notes for Difference between SAM, LSASS, LSA and MSCache, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.Difference between SAM, LSASS, LSA and MSCache
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/active-directory/credentials.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.