Unattended Installation Credentials

Unattended Windows installations are driven by answer files (unattend.xml, sysprep.xml, sysprep.inf) that automate Windows Setup — partitioning, product keys, and account creation. When administrators image machines at scale, the local administrator password is embedded in these files, and if the files are not cleaned up after deployment they persist on the finished system as a credential source for anyone with read access.

Where the files land

Common leftover locations:

C:\unattend.xml
C:\Windows\Panther\Unattend.xml
C:\Windows\Panther\Unattend\Unattend.xml
C:\Windows\System32\sysprep.inf
C:\Windows\System32\sysprep\sysprep.xml
C:\Windows\System32\Sysprep\Panther\unattend.xml

C:\Windows\Panther\ is the most common finding — it holds Setup’s working files and logs. The Microsoft-Windows-Shell-Setup component’s <AutoLogon> and <LocalAccounts> blocks contain <Password> elements; the <Value> is frequently Base64-encoded UTF-16LE (with <PlainText>false</PlainText>), which is obfuscation, not encryption — trivially decoded with echo '<b64>' | base64 -d or PowerShell’s [Convert]::FromBase64String.

Discovery

dir /b /s C:\unattend.xml
dir /b /s C:\sysprep.inf
dir /b /s C:\sysprep.xml

Automated privesc enumerators check these paths out of the box: PowerSploit’s Get-UnattendedInstallFile (PowerUp), winPEAS (“Interesting files”), and the Metasploit post/windows/gather/enum_unattend module.

Attack and defense notes

• MITRE ATT&CK maps this to T1552.001 (Unsecured Credentials: Credentials in Files).
• The recovered password is often the image local admin password — reused across every machine built from that image, so one file can yield enterprise-wide lateral movement (try it with pass-the-hash against other hosts).
• Defense: delete answer files in the image-sealing step (sysprep /generalize does not reliably remove copies under Panther), rotate the built-in administrator password after deployment (LAPS), and audit for unattend.xml/sysprep.* remnants on deployed hosts. Alert on reads of these paths by non-SYSTEM processes.

Related

• windows-saved-credentials — another host-local credential store (Credential Manager)
• iis-configuration-credentials — the parallel pattern for web server config files
• windows-reconnaissance-commands — built-in discovery commands that locate these files
• putty-saved-sessions — cleartext credentials stored in the registry by an application

Sources

• Unsecured Credentials: Credentials In Files (T1552.001) | MITRE ATT&CK
• 2017 — Stored Credentials — Penetration Testing Lab
• Password Hunting — Windows Privilege Escalation