是否可以以编程方式备份/恢复 Windows 域/证书凭据？
我一直在尝试使用 Windows 身份验证低级凭据 API 函数来备份/恢复凭据。
但是，我发现虽然我可以使用 CredEnumerate 获取系统上的每个凭据，但域类型凭据的所有密码都丢失（有记录）。有没有办法像 Windows GUI 工具一样备份/恢复这些凭据？
I've been trying to use the Windows Authentication low level credential API functions to backup/restore credentials.
However, I've found that while I can use CredEnumerate to obtain every credential on the system, all the passwords are missing for domain type credentials (which is documented). Is there any way to backup/restore these credentials in the same way as the windows GUI tool can?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
嗯，看来我找到了答案，虽然我不喜欢它。执行此操作的唯一方法似乎是 CreateRemoteThread() 在 lsass.exe （Windows 安全子系统）中创建一个线程，然后使用从 Lsasrv.dll 导出的未记录函数 LsaICryptUnprotectData 枚举该线程内的凭据以解密凭据缓冲。
它有效，但我不确定我是否有勇气将其放入我的软件中......
Hmm, it looks like I've found the answer although I don't like it. The only way to do this seems to be to CreateRemoteThread() to create a thread in lsass.exe (The windows security subsystem) and then to enumerate the credentials from within that thread using undocumented function LsaICryptUnprotectData exported from Lsasrv.dll to decrypt the credentials buffer.
It works but I'm not sure I have the stomache to put this into my software...