GPP passwords cpassword
Microsoft let administrators set local passwords via group policy, encrypted with AES-256 — and published the key in its own documentation.
The feature arrived with Group Policy Preferences in 2008 and was genuinely useful: a way to set the same local administrator password across the estate without writing a script. The password ended up in an XML field called cpassword in a file in SYSVOL. The encryption was strong, but the static key was printed in the public protocol specification, and SYSVOL is by design readable by every authenticated user in the domain. Anyone could therefore fetch and decrypt it. Microsoft removed the ability to set new such passwords in 2014 but never deleted existing files, which is why the finding still turns up a decade later — go looking in SYSVOL before somebody else does.