Security Audit: Passwords Found in Spreadsheets and Documents

LIMEHAWK - Managed IT

Home>Incident Reports>Security Audit: Passwords Found in Spreadsheets and Documents

Incident

A financial services client was in the middle of a SOC 2 audit when their auditor asked the question that kills a lot of MSPs: "Can you prove no plaintext passwords are stored on employee workstations?" The client had a password manager deployed across the org — that part was fine. What they couldn't prove was that users weren't ALSO keeping a backup copy of their logins in an Excel file on the desktop. We needed to scan 67 endpoints and produce an answer before the auditor's next visit.

The risk

Even with a password manager deployed, users hedge. They get a temporary vendor login, they're in a hurry, they throw it in a text file so they can find it later. Then the text file never goes away. The usual suspects are boring and consistent:

- passwords.xlsx on the Desktop
- logins.txt in Documents
- creds.docx emailed to self as a "backup"
- "New Passwords" page in OneNote
- shared-accounts.xlsx on a departmental share

These files are a goldmine if an attacker gets endpoint access. Phishing succeeds, an infostealer runs, and every password in that spreadsheet is on a criminal marketplace inside an hour. SOC 2 requires demonstrating control over credential storage, not just that you deployed a vault.

Solution

We deployed a scan across all endpoints that looks for filenames matching password-related patterns. It uses the Windows Search index where it's available for speed, and falls back to straight filesystem traversal on machines where the index is stale or disabled. Results get reported back through the RMM so we can pull a single consolidated report.

What it finds

The script matches filename patterns across every user profile on the box. It covers the obvious variants: *password*, *credential*, *login*, *secret*. It skips system folders and application caches so we're not chasing false positives in browser cache directories or installer files. For each hit it reports the full path, file size, and last modified date — enough context to decide whether a file is worth investigating without cracking it open.

- *password* — files with "password" in the name
- *credential* — credential lists
- *login* — login sheets and saved logins
- *secret* — secret keys, tokens, API keys
- scans all user profile directories
- excludes system folders and application caches

Security note

The script doesn't read file contents — that's deliberate. Reading contents means logs contain credential excerpts, which creates a new exposure problem. Filename-only scanning finds the candidates; a human reviews the ones that matter. Treat the output itself as sensitive data: it's a map of your weakest credential storage. Securely delete password files (sdelete or equivalent) after migrating into the manager.

Outcome

Scan finished in about 12 minutes across the whole fleet. It flagged 23 files total. Of those, 8 had actual working credentials when we reviewed them with the users — banking logins, a couple of vendor portal passwords, a shared service account sheet that somebody had forgotten about. The other 15 were false positives: file names that matched the pattern but contained things like password policy documents or HR new-hire password guidance.

We walked each user through migrating the real credentials into the password manager, then securely wiped the originals. Handed the auditor a clean remediation report showing what was found, what was moved, and what was destroyed. They signed off on the control.

- endpoints scanned: 67
- files found: 23
- confirmed credential files: 8
- scan duration: 12 minutes

Key takeaways

Takeaway

password managers don't prevent users from making backup files.

Takeaway

periodic filename scans catch policy drift without reading contents.

Takeaway

findings give you a real user-education moment, not a hypothetical one.

Takeaway

documented remediation is what actually satisfies the auditor.

Need help with something like this? Contact us

• Getting Verification Codes You Didn't Request? How to Tell Spam From Account Compromise (Security)

• Finding Your BitLocker Recovery Key After a Windows Update Breaks Boot (Security)

• BEC Wire Fraud at a Title Company: How We Stopped a High-Six-Figure Loss (Security)