PowerShell script that decrypts passwords stored in the Windows Registry that have been encrypted using DPAPI (Data Protection API)

dpapi-registryDecryptor.ps1

param(
    [Parameter(Mandatory=$true)]
    [string]$RegistryPath,
    
    [Parameter(Mandatory=$true)]
    [string]$ValueName,
    
    [Parameter(Mandatory=$true)]
    [ValidateSet("LocalMachine", "CurrentUser")]
    [string]$Scope
)

Add-Type -AssemblyName System.Security  

# Convert scope parameter to enum
$protectionScope = [System.Security.Cryptography.DataProtectionScope]::$Scope

try {
    # Read the encrypted blob from the registry
    $encryptedString = (reg query $RegistryPath /v $ValueName | findstr 'REG_SZ')  
    
    if (-not $encryptedString) {
        Write-Host "it wasn't possible to decrypt" -ForegroundColor Red
        exit 1
    }
    
    $encryptedString = $encryptedString.Trim() -replace '^.*REG_SZ\s+', ''  
    $encryptedBytes = [Convert]::FromBase64String($encryptedString)  
    $decryptedBytes = [System.Security.Cryptography.ProtectedData]::Unprotect($encryptedBytes, $null, $protectionScope)  
    $plaintextPassword = [System.Text.Encoding]::UTF8.GetString($decryptedBytes)  
    
    # Check if decrypted password is empty or null
    if ([string]::IsNullOrEmpty($plaintextPassword)) {
        Write-Host "it wasn't possible to decrypt" -ForegroundColor Red
        exit 1
    }
    
    $plaintextPassword
}
catch {
    Write-Host "it wasn't possible to decrypt" -ForegroundColor Red
    exit 1
}

Usage:

.\dpapi-registryDecryptor.ps1 -RegistryPath 'HKLM\SOFTWARE\Service -ValueName 'EncryptedPassword' -Scope LocalMachine

Note

First verify the registry values:

1. reg query 'HKEY_LOCAL_MACHINE\SOFTWARE\'
2. reg query 'HKEY_LOCAL_MACHINE\SOFTWARE\InterestingApp'