Use Credential Manager and DPAPI with the protecting context

Needs: Access to the protected data plus matching user/machine context, master-key material or an appropriate recovery factor

Windows commands

REM Baseline
cmdkey /list
vaultcmd /list
vaultcmd /listcreds:"Windows Credentials" /all

PowerShell commands

# Baseline
Get-ChildItem "$env:APPDATA\Microsoft\Credentials" -Force -ErrorAction SilentlyContinue
Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Credentials" -Force -ErrorAction SilentlyContinue
Get-ChildItem "$env:APPDATA\Microsoft\Protect" -Force -Recurse -ErrorAction SilentlyContinue

DPAPI reasoning

# DPAPI reasoning
PROTECTED BLOB
-> MASTER-KEY GUID
-> USER OR MACHINE PROTECT SCOPE
-> MASTER-KEY DECRYPTION MATERIAL
-> APPLICATION-SPECIFIC DECODING

Verify → Verify the decrypted value or actual saved-credential action in its matching context.

If it fails → Missing master keys, wrong protecting identity or incomplete artifacts require another source/context. More detail ↓

If → then

A secret-like value, key file, stored hash, challenge response or ticket → Classify the artifact and its identity context
Needs: Artifact provenance and format; possible local/domain/application identity and compatible protocol
A password tied to a plausible user and service → Validate known passwords and context-specific reuse
Needs: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state
Readable application configuration, unattended setup, PowerShell trails or Credential Manager entries → Recover Windows application, history and stored-credential artifacts
Needs: Artifact read permission and exact protecting identity/context for saved or DPAPI material

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Use Credential Manager and DPAPI with the protecting context

USE WHEN: Saved credentials or protected application blobs/master keys
STARTING ACCESS: A domain identity, appropriate host privilege, or a validated effective directory-object right
RESULT: A usable saved-credential operation or decrypted secret for a defined identity

Recognize the clue

Inspect saved-credential targets and readable protected files within the current protecting user/machine context.

whoami /user
cmdkey /list

SYNTHETIC EXAMPLE OUTPUT

Protecting user: USER_SID
Credential target: TARGET_HOST
Available artifact: protected blob; plaintext not shown

Means: The target and protecting SID identify which keys/context or consumer must be investigated.

Confirm: Check matching master keys/recovery factors or an allowed saved-credential consumer; file read alone is insufficient.

After validation: Matching protection factors decrypt the material or the intended consumer works: use that bounded capability.
Ruled out in this context: Only a blob from an unrelated user is present without its required factors: reject the current decryption route.
Still inconclusive: A cmdkey listing without usable context does not establish a password.

Troubleshooting: Missing master keys, wrong protecting identity or incomplete artifacts require another source/context.

Additional prerequisite checks

cmdkey /list
whoami /all

For each entry record target, type, username, persistence/context and whether a compatible application can ask Windows to use it. A listed credential is not necessarily exportable plaintext.

DPAPI reasoning:

Possible decryption material includes the already logged-on user context, the user's password/NT hash, machine context or a domain DPAPI backup key. Prefer using the authorized existing context rather than copying unrelated protected data. One blob without its master key/context is incomplete.

Why it works

DPAPI ties protection to user/machine keys and context. A blob or cmdkey listing alone does not disclose plaintext, and a stored credential may be target/logon-type bound.

Worked example · hypothetical

Observation: saved credentials reference a remote host. Test: inspect the available matching user context and intended consumer. Illustrative output: the saved credential permits that target action but reveals no password. Interpretation: record the capability rather than inventing a plaintext secret.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗