misc::skeleton
. After that, you can authenticate as any user with the default password of Mimikatz.Get-WinEvent -FilterHashtable @{Logname='System';ID=7045} | ?{$_.message -like "
Kernel Mode Driver"}
Get-WinEvent -FilterHashtable @{Logname='System';ID=7045} | ?{$
.message -like "Kernel Mode Driver" -and $
.message -like "
mimidrv
"}
New-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name RunAsPPL -Value 1 -Verbose
Get-WinEvent -FilterHashtable @{Logname='System';ID=12} | ?{$_.message -like "
protected process"}