Loot the Credential Manager and Windows Vault

Saved RDP, web, and network credentials in the Vault are DPAPI-protected but decrypt trivially in the user's own session.