Loot the Credential Manager and Windows Vault
Saved RDP, web, and network credentials in the Vault are DPAPI-protected but decrypt trivially in the user's own session.
Tag: dpapi
Decrypt DPAPI secrets with the domain backup key
With the domain DPAPI backup key from a DC, you can decrypt any user's masterkeys and the browser, vault, and RDP secrets they protect, offline.