Trebek 1

The password for trebek2 is the name of the script referenced in a deleted task as depicted in the event logs on the desktop.

NOTE:
– Don’t include the file extension (i.e.- .vbs)
– The password will be lowercase no matter how it appears on the screen.

IMPORTANT:
Once you feel you have completed the Trebek1 challenge, start a new connection to the server, and log in with the username of Trebek2 and this password will be the answer from Trebek1. If successful, close out the Trebek1 connection and begin to solve the Trebek2 challenge. This concept is repeated over and over until you reach the end of the game.

▼ HINT:

https://msdn.microsoft.com/en-us/powershell/reference/5.1/microsoft.powershell.diagnostics/get-winevent


▼ HINT:

You may want to look at what data is available on a typical log containing this data…