I'm following this article to decrypt windows vault (On Windows 7 x86)
I've added two credentials for testing,
But in either Local or Roaming, I have nothing in the Credentails folder
Where I only have a policy file
What could be wrong here?
And if I'm going to do this with mimikatz alone, what commands should I use? The official wiki is empty
Maybe try this to show important files in your explorer?
Despite 'Vault' name in the Windows control panel, credentials still stored as legacy: %localappdata%\Microsoft\Credentials
Take a look in mimikatz_dpapi.xlsx for DPAPI-related storage locations.
And you can deal with them with: dpapi::cred /in:file using mimikatz, see this Wiki entry (this is the origin of the above link).
