Credentials

Windows stores credentials using DPAPI's symmetric encryption, protected by user keys stored in %APPDATA%\Microsoft\Protect\%sid%. There are a number of tools for accessing these included with Windows:

  • Credential Manager, which won't show corrupted and "hidden" entries.
  • rundll32.exe keymgr.dll,KRShowKeyMgr to show entries.
  • cmdkey
  • vaultcmd

For easier access to values, NirSoft CredentialsFileView may be useful.