I'm following this article to decrypt windows vault (On Windows 7 x86)

I've added two credentials for testing,

enter image description here

But in either Local or Roaming, I have nothing in the Credentails folder

enter image description here

Where I only have a policy file

enter image description here

What could be wrong here?

And if I'm going to do this with mimikatz alone, what commands should I use? The official wiki is empty


Maybe try this to show important files in your explorer?

Maybe try this?


Despite 'Vault' name in the Windows control pannel, credentials still stored as legacy: %localappdata%\Microsoft\Credentials

Take a look in: https://1drv.ms/x/s!AlQCT5PF61KjmCAhhYO0flOcZE4e

And you can deal with them with: dpapi::cred /in:file, by eg.

  • What's the link? What content is there? Why should a user look there? Can you expand your answer? – h4ckNinja Nov 20 '17 at 3:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.