https://pastein.ru/t/ESE
Загрузка данных
C:\Users\User>reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "Authentication Packages"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
Authentication Packages REG_MULTI_SZ msv1_0\0SshdPinAuthLsa
C:\Users\User>reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "Security Packages"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
Security Packages REG_MULTI_SZ ""
C:\Users\User>reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "Notification Packages"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
Notification Packages REG_MULTI_SZ scecli
C:\Users\User>reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
auditbasedirectories REG_DWORD 0x0
auditbaseobjects REG_DWORD 0x0
Bounds REG_BINARY 0030000000200000
crashonauditfail REG_DWORD 0x0
fullprivilegeauditing REG_BINARY 00
LimitBlankPasswordUse REG_DWORD 0x1
NoLmHash REG_DWORD 0x1
Security Packages REG_MULTI_SZ ""
Notification Packages REG_MULTI_SZ scecli
Authentication Packages REG_MULTI_SZ msv1_0\0SshdPinAuthLsa
disabledomaincreds REG_DWORD 0x0
everyoneincludesanonymous REG_DWORD 0x0
forceguest REG_DWORD 0x0
LsaCfgFlagsDefault REG_DWORD 0x0
LsaPid REG_DWORD 0x330
ProductType REG_DWORD 0x6
restrictanonymous REG_DWORD 0x0
restrictanonymoussam REG_DWORD 0x1
SecureBoot REG_DWORD 0x1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders
MartaExtension REG_SZ ntmarta.dll
ProviderOrder REG_MULTI_SZ Windows NT Access Provider
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders\Windows NT Access Provider
ProviderPath REG_EXPAND_SZ %SystemRoot%\system32\ntmarta.dll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy
AuditPolicySD REG_BINARY 01000000D08C9DDF0115D1118C7A00C04FC297EB0100000071866E7A4BCC5749818FE3F91DF50C480000002000000000106600000001000020000000552DC7CFAEE846BE5192276510D8BE36A4BA2149E47AF2C28E80909E36F0A325000000000E800000000200002000000081B80656CF2C27902D22EA9F61A8279115950B4C88A696B2E2923D77BB1699E27000000007BF8057BA363BCCDBE4238392A2A2E65D89484C222583C98673B8FD67F5F3F4383D35F30D76761E7E76FE6B869DFD543FD875FE738D362B91721C714355A52A1FAD6A88A963A21EE39B53DB069476375C8100F41CB4B7B9335F9D407E261AA3CE3A97E337FEF412A066867079A860724000000030B5E597FBFBBA860BDE87F30E48CCE4FF9915135BFF0B3081917F5B1F4DBDDE5333AEF4A580A10C472D8D30E7C3150E33879E44EDC74ADCACF59666A199159B
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\CentralizedAccessPolicies
MaxDataSize REG_DWORD 0x0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\CentralizedAccessPolicies\CAPEs
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\CentralizedAccessPolicies\CAPs
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\ComponentUpdates
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\ComponentUpdates\Privileges
01F9BAE5-4C53-4339-A356-40E5B3A3E577 REG_SZ PrivilegeAdd;S-1-5-80-3169285310-278349998-1452333686-3865143136-4212226833;SeServiceLogonRight
C4C85B72-59EB-4DDB-9EF0-ECF40A264FF5 REG_SZ PrivilegeAdd;S-1-5-80-3169285310-278349998-1452333686-3865143136-4212226833;SeSystemTimePrivilege
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\ComponentUpdates\SecurityInstallationProvider
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\ComponentUpdates\SecurityInstallationProvider\S-1-5-19
Group1 REG_BINARY 0109000000000005200000005796D816CD3DB8C73AB6AB6D682E796C5EFA8B5D5A1040FA9746B304437C4254
Group2 REG_BINARY 0109000000000005200000001BCA59796509E3107A29F9CB5919D9D599A9A72D9544DAB4728F4AD30BD93024
Group3 REG_BINARY 01090000000000052000000017881EDA76478088332F1143FE5053DB3EDC124D18F400817D92F569579BBB9A
Group4 REG_BINARY 010900000000000520000000502EB30038039D7D04D93ACD696F76F6DC95E8E446FA83DF6F5B17E5AD34FE27
Group5 REG_BINARY 010900000000000520000000B0770AD29DE60F68036B552F52EF4928B4BA566FC7E5577490AB44428E32587A
Group6 REG_BINARY 01090000000000052000000092DFB758F1CD0F33EA60535A51DB4C523E8B7FB1F28FD184049FD034929309A7
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp
DebugLogLevel REG_DWORD 0x0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowDefaultCredentials
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowDefaultCredentialsDomain
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowDefaultCredentialsWhenNTLMOnly
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowDefaultCredentialsWhenNTLMOnlyDomain
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowFreshCredentials
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowFreshCredentialsDomain
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowFreshCredentialsWhenNTLMOnly
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowFreshCredentialsWhenNTLMOnlyDomain
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowSavedCredentials
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowSavedCredentialsDomain
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowSavedCredentialsWhenNTLMOnly
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowSavedCredentialsWhenNTLMOnlyDomain
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenyDefaultCredentials
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenyDefaultCredentialsDomain
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenyFreshCredentials
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenyFreshCredentialsDomain
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenySavedCredentials
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenySavedCredentialsDomain
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Data
Pattern REG_BINARY BEA741AB65C279DE4A2269ED68B7260F
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\DPL
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
Enabled REG_DWORD 0x0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\GBG
GrafBlumGroup REG_BINARY 68D4F955E511954E1E
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\JD
Lookup REG_BINARY 1E32ADB1A49F
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\HostToRealm
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
Auth132 REG_SZ IISSUBA
NtlmMinClientSec REG_DWORD 0x20000000
NtlmMinServerSec REG_DWORD 0x20000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\OfflineLSA
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\OfflineLSA\DBOptions
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\OfflineSAM
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\OfflineSAM\DBOptions
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Skew1
SkewMatrix REG_BINARY AC642BCC96AF739D4A455A25D1C1657A
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SSO
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SSO\Passport1.4
SSOURL REG_SZ http://www.passport.com
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache
Time REG_BINARY 21450DC273F4DB01
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\credssp.dll
Capabilities REG_DWORD 0x810733
Comment REG_SZ Microsoft CredSSP Security Provider
Name REG_SZ CREDSSP
RpcId REG_DWORD 0xffff
Time REG_BINARY D9AC59758BF0DB01
TokenSize REG_DWORD 0x11d48
Type REG_DWORD 0x21
Version REG_DWORD 0x1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Tracing
C:\Users\User>