ERROR dpapi::masterkey password doesn't get accepted. What can I do now?
Im on Windows 11 Pro x64 (10.0.22631, 23H2) NL. Clean installation on new hardware. Previous Windows installation was overwritten during fresh install using same ssd. System is fully up to date. The issue did not occur after a Windows update, but after OS reinstallation and hardware change.
mimikatz 2.2.0 x64 (official precompiled binary). Tested with multiple versions, same behavior Windows x64 with mimikatz x64 (no WOW64). Ran as Administrator
EFS recovery attempt. Not a live credential extraction scenario.
Only 4 modules were used:
- lsadump::sam /system:SYSTEM /SAM:SAM
- dpapi::masterkey /password
- crypto::capi
- crypto::cng
No other modules used:
- Encrypt files using EFS on Windows 10
- Do not export EFS certificate (.pfx)
- Fresh install Windows (same Microsoft account)
Restore only:
- AppData\Roaming (Microsoft, RSA, Crypto, Protect)
Lost:
- User folder
- NTLM hash
Context: Original Windows login was via Microsoft account. User was always logged in with the same visible password original. NTLM hash is lost. No backup of EFS In certmng, but the EFS certification is shown (from the old windows).
Attempt:
- dpapi::masterkey /in: /password:<old_password>
- lsadump::sam /system:SYSTEM /SAM:SAM
Result:
- ERROR kuhl_m_dpapi_masterkey ; kull_m_dpapi_unprotect_masterkey_with_password (It doesnt accept the password, even though i know what my password is for sure.)
- ERROR (ERROR kuhl_m_lsadump_sam ; CreateFile (SYSTEM hive) (0x00000002))
Source: gentilkiwi/mimikatz