LIMEHAWK - Managed IT
Wi-Fi Credential Recovery — automation
dateSep 12, 2024
statusRESOLVED
Incident

New client emergency: moving offices in 48 hours. Previous IT person quit abruptly, left zero documentation. Nobody knew Wi-Fi passwords for the guest network, warehouse APs, or conference room networks. 23 different SSIDs saved on various laptops - passwords unknown. Factory reset the access points? Lose all the configs. Need credentials NOW.

The Knowledge Gap
IT documentationnone (previous admin kept in his head)
password managerexisted but not shared with org
AP admin accessunknown credentials
ISP router logindefault was changed, unknown

Classic scenario: single point of failure IT. When that person leaves, all institutional knowledge leaves with them. But Windows stores every Wi-Fi password the machine has ever connected to - if you know where to look.

How Windows Stores Wi-Fi
profiles in registryHKLM\SOFTWARE\Microsoft\Wlansvc
keys encryptedwith machine DPAPI
netsh accessdecrypts as SYSTEM/Admin

netsh wlan show profile name="SSID" key=clear reveals the plaintext password - but only with admin privileges. Running via RMM as SYSTEM gives us access to every saved network on every managed device.

Solution

Deploy via RMM to extract all saved Wi-Fi credentials from every endpoint. Cross-reference results to build complete list of network passwords.

Security Note

This script retrieves sensitive credentials. We only run it on systems we're authorized to manage, for legitimate recovery purposes. Output is captured in RMM logs (encrypted at rest) and shared only with authorized personnel. After documentation is complete, we recommend rotating all recovered passwords.

Outcome
endpoints scanned34 workstations
unique SSIDs found23 networks
passwords recovered23 of 23
time to complete12 minutes

Script ran across 34 machines in parallel. Some machines had passwords others didn't (employee laptops vs warehouse terminals). Consolidating results gave us every network credential. Move proceeded on schedule. Created proper documentation in client's password manager afterward.

Windows stores every Wi-Fi password the device has used
netsh with key=clear requires admin/SYSTEM privileges
RMM deployment extracts from entire fleet simultaneously
always document and rotate credentials after recovery
Get Help

Lost IT documentation or need credential recovery? We help organizations regain control of their infrastructure with proper documentation.