LSASecretsView - View LSA secrets stored on your computer

LSASecretsView v1.26 - View LSA secrets stored on your computer
Copyright (c) 2006 - 2024 Nir Sofer

Description

LSASecretsView is a small utility that displays the list of all LSA secrets stored in the Registry on your computer.
The LSA secrets key is located under HKEY_LOCAL_MACHINE\Security\Policy\Secrets and may contain your RAS/VPN passwords, Autologon password, and other system passwords/keys.

Versions History

Version 1.26:
- Fixed a problem with decrypting LSA secrets from external drive on Windows 11 22H2.
Version 1.25:
- Updated to work on Windows 8 and Windows 10.
- Added support for reading LSA secrets from external drive of Windows 10/8/7.
- External drive reading - You can now specify the Registry hives folder (e.g: K:\windows\system32\config) insread of windows directory.
Version 1.21 - Fixed a problem with Application Compatibility Engine on Windows 7/Vista: In some rare circumstances, this utility was shimmed by Application Compatibility Engine, which means that apphelp.dll and AcLayers.DLL were loaded into the process and replaced the Windows API pointers in the exports table. This API replacement caused this utility to crash lsass.exe and restart the operating system after a minute.
This problem occured when running this utility from NirLauncher package, because the executable of NirLauncher contains the word 'launch', and from unknown reason, Microsoft automatically shim every executable that contains the word 'launch'.
Version 1.20 - Added support for reading the LSA secrets from external instance of Windows 2000/XP/2003. (In Advanced Options).
Version 1.13 - Fixed bug: The main window lost the focus when the user switched to another application and then returned back to LSASecretsView.
Version 1.12 - The configuration is now saved to a file, instead of the Registry.
Version 1.11 - Under Vista, LSASecretsView now automatically requires to run as administrator.
Version 1.10 - Added support for Windows Vista (both 32-bit and x64 versions)
Version 1.00 - First release.

License

This utility is released as freeware. You are allowed to freely distribute this utility via floppy disk, CD-ROM, Internet, or in any other way, as long as you don't charge anything for this. If you distribute this utility, you must include all files in the distribution package, without any modification !

Disclaimer

The software is provided "AS IS" without any warranty, either expressed or implied, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. The author will not be liable for any special, incidental, consequential or indirect damages due to loss of data or any other reason.

Known Problems

False Alert Problems: Some Antivirus programs detect this utility as infected with Trojan/Virus.

Using LSASecretsView

LSASecretsView doesn't require any installation process or additional DLLs. Just copy the executable file (LSASecretsView.exe) to any folder you like, and run it.
The main window of LSASecretsView contains 2 panes: The upper pane displays the list of all LSA secret entries. When you select one or more items in the upper pane, the lower pane displays the LSA data of the selected items, in Hex and Ascii formats.

Reading LSA secrets from external instance of Windows

Starting from version 1.20, LSASecretsView allows you to read the LSA secrets from external instance of Windows. This feature can be useful if you have a dead system that cannot boot anymore. You can use this feature from the user-interface, by using the 'Advanced Options' in the File menu, or from command-line, by using /external parameter, for example:
LSASecretsView.exe /external g:\windows

System Requirement

This utility works on 2000/XP/2003/2008/Vista/7/8/10. Windows 98/ME is not supported.

Translating LSASecretsView to other languages

In order to translate LSASecretsView to other language, follow the instructions below:

Run LSASecretsView with /savelangfile parameter:
LSASecretsView.exe /savelangfile
A file named LSASecretsView_lng.ini will be created in the folder of LSASecretsView utility.
Open the created language file in Notepad or in any other text editor.
Translate all string entries to the desired language. Optionally, you can also add your name and/or a link to your Web site. (TranslatorName and TranslatorURL values) If you add this information, it'll be used in the 'About' window.
After you finish the translation, Run LSASecretsView, and all translated strings will be loaded from the language file.
If you want to run LSASecretsView without the translation, simply rename the language file, or move it to another folder.

Feedback

If you have any problem, suggestion, comment, or you found a bug in my utility, you can send a message to nirsofer@yahoo.com

Download LSASecretsView

Download LSASecretsView for x64

LSASecretsView is also available in other languages. In order to change the language of LSASecretsView, download the appropriate language zip file, extract the 'lsasecretsview_lng.ini', and put it in the same folder that you Installed LSASecretsView utility.

Language Translated By Date Version

Arabic Shanaab! 22/09/2015

Dutch Jan Verheijen 21/01/2024 1.26

French Largo 23/01/2024 1.26

French PasswordOne 09/12/2008

Galician Xosé Antón Vicente Rodríguez 05/07/2008

German «Latino» auf WinTotal 21/01/2024 1.26

Greek geogeo.gr 21/07/2016 1.25

Hebrew peterg 29/04/2011

Hungarian ZityiSoft 20/06/2009

Italian Giacomo Margarito 30/01/2024

Persian ZendegiyeSabz 29/01/2024 1.26

Polish KartsAnd 04/06/2010

Romanian Jaff (Oprea Nicolae) 29/03/2013 1.21

Russian Dmitry Yerokhin 18/07/2016

Simplified Chinese DickMoore 02/02/2024 1.26

Slovak František Fico 04/03/2024 1.26

Spanish Angel De Giorgi 01/05/2012 1.21

Traditional Chinese Danfong Hsieh 24/07/2016

Traditional Chinese 發夢 King 09/12/2008 1.20

Thai HS3PLN 25/03/2008

Turkish HARUN ARI 20/01/2024 1.26

Valencian vjatv 31/01/2008

Related Links