#472·mimikatz

ERROR dpapi::masterkey password doesn't get accepted. What can I do now?

Author: HavyProgramGiuyCreated Dec 20, 2025Updated Dec 20, 2025

Im on Windows 11 Pro x64 (10.0.22631, 23H2) NL. Clean installation on new hardware. Previous Windows installation was overwritten during fresh install using same ssd. System is fully up to date. The issue did not occur after a Windows update, but after OS reinstallation and hardware change.

mimikatz 2.2.0 x64 (official precompiled binary). Tested with multiple versions, same behavior Windows x64 with mimikatz x64 (no WOW64). Ran as Administrator

EFS recovery attempt. Not a live credential extraction scenario.

Only 4 modules were used:

  • lsadump::sam /system:SYSTEM /SAM:SAM
  • dpapi::masterkey /password
  • crypto::capi
  • crypto::cng

No other modules used:

  • Encrypt files using EFS on Windows 10
  • Do not export EFS certificate (.pfx)
  • Fresh install Windows (same Microsoft account)

Restore only:

  • AppData\Roaming (Microsoft, RSA, Crypto, Protect)

Lost:

  • User folder
  • NTLM hash

Context: Original Windows login was via Microsoft account. User was always logged in with the same visible password original. NTLM hash is lost. No backup of EFS In certmng, but the EFS certification is shown (from the old windows).

Attempt:

  1. dpapi::masterkey /in: /password:<old_password>
  2. lsadump::sam /system:SYSTEM /SAM:SAM

Result:

  1. ERROR kuhl_m_dpapi_masterkey ; kull_m_dpapi_unprotect_masterkey_with_password (It doesnt accept the password, even though i know what my password is for sure.)
  2. ERROR (ERROR kuhl_m_lsadump_sam ; CreateFile (SYSTEM hive) (0x00000002))