[REQUEST] Pulling password from exchange account

[Menaice]

I got a new client, and one of their laptops they just got back from this other repair shop, its a mess. windows wasn't activated some basic functions didn't work. So i imaged the system, did another backup. Reloaded the OS put everything back. There is 1 email account in the outlook that is an exchange account and of course they have no idea what the password is. I took the image i put it into hyper v running it as a VM. the exchange account connects and fully works. I ran mail pass view it only picked up the pop3 account. Does anyone know if there is a way of extracting the password for that hosted exchange from the outlook 2007?
MX record points to: us-smtp-1.mimecast.com
Since its connected i would assume its able to be captured...
Thanks in advance

 

[Markverhyden]

What's wrong with resetting it?

 

[Menaice]

Holiday here, its a hosted exchange account, called the company only voice recording

 

[nlinecomputers]

Since its connected i would assume its able to be captured...

Nope. That is an encrypted connection.

You can backup the credential store in Windows and restore to the new unit. That MIGHT get your cached creds for Outlook but I don't think so.

 

[nlinecomputers]

http://www.digitalcitizen.life/how-backup-and-restore-windows-vault-passwords

 

[Markverhyden]

http://www.digitalcitizen.life/how-backup-and-restore-windows-vault-passwords

Thanks. Nice find.

 

[Menaice]

Thanks for the help, i was able to use a decryptor tool and get the password for the exchange account from the windows credentials. I called the hosting company 3 times and they completely denied they hosted it. I called the company to where the MX record points to and they said "yes its hosted here but managed by XYZ company" i said "they told me they had no idea who you where" This went on for 2 hours. Then i found a decryptor tool pulled the passwords and go to reconnected. Created a client configuration file for this and saved it into connectwise for future use. What a nightmare over something so simple!!!!

 

[Markverhyden]

Thanks for the help, i was able to use a decryptor tool and get the password for the exchange account from the windows credentials. I called the hosting company 3 times and they completely denied they hosted it. I called the company to where the MX record points to and they said "yes its hosted here but managed by XYZ company" i said "they told me they had no idea who you where" This went on for 2 hours. Then i found a decryptor tool pulled the passwords and go to reconnected. Created a client configuration file for this and saved it into connectwise for future use. What a nightmare over something so simple!!!!

Care to share the tool you used?

 

[Menaice]

Sure, i got it from here
http://securityxploded.com/windows-vault-password-decryptor.php worked