Auditing Windows Credential Manager: The Stored Passwords Attackers Dump With cmdkey And vaultcmd

Every credential-theft conversation on Windows starts and ends at LSASS. Defenders deploy Credential Guard, enable RunAsPPL, and hunt for handles to lsass.exe — and they should. But there is a quieter store that sits on disk, survives reboots, and hands an attacker working credentials without ever touching process memory: Windows Credential Manager. It is where saved RDP passwords, mapped-drive credentials, and browser/web logins live, and it is trivially enumerable by any process running as the logged-on user.

What Credential Manager actually holds

Credential Manager is the user-facing front end to two vaults: the Windows Credentials store (generic and domain credentials used by the OS — RDP via Terminal Services, SMB share mappings, runas /savecred entries) and the Web Credentials store (logins saved by Edge/IE and some apps). Both are encrypted with DPAPI under the user's master key, which means an attacker who already has the user's context — a phished session, a token, an interactive foothold — can decrypt them without cracking anything.

The dangerous entries are the ones that let an attacker reuse a credential elsewhere:

• TERMSRV/* — saved RDP passwords. A single stored TERMSRV/dc01 entry can be enough to pivot to a domain controller.
• Domain:target=* — cached network-share and service credentials.
• runas /savecred entries — a saved admin credential that any process can invoke without a prompt.
• Web credentials for internal apps, VPN portals, and admin consoles.

How attackers enumerate and abuse it

None of this requires malware. The tooling ships in the box. To list what is stored:

:: Enumerate stored Windows credentials (targets, not plaintext)
cmdkey /list

:: Enumerate the Web Credentials vault
vaultcmd /listcreds:"Web Credentials" /all
vaultcmd /list

The real abuse is that saved credentials can be used without ever being read back as plaintext. If cmdkey /list shows a TERMSRV/dc01 entry, an attacker just launches mstsc /v:dc01 and Windows silently supplies the stored password. Likewise a runas /savecred entry runs an elevated command with no prompt:

:: Reuse a saved RDP credential — no password needed
mstsc /v:dc01

:: Reuse a saved admin credential
runas /savecred /user:CONTOSO\svc-admin "cmd /c whoami"

For actual plaintext extraction, post-exploitation tooling walks the DPAPI blobs under %APPDATA%\Microsoft\Credentials and %LOCALAPPDATA%\Microsoft\Credentials, decrypting them with the user's master key. This is the same DPAPI looting path used against browser secrets — Credential Manager is just another consumer of it. Because the read happens in the user's own context, it generates no LSASS access events at all.

Why this evades the usual defenses

Credential Guard protects LSASS secrets. It does nothing for credentials a user chose to save to disk.

That is the crux. Teams that have hardened LSASS often assume credential theft is handled. But a saved TERMSRV password is a plaintext-equivalent stored outside LSASS's protection boundary, readable in-context, and usable without a single memory read. Detection is hard because cmdkey.exe, vaultcmd.exe, mstsc.exe, and runas.exe are all legitimate signed binaries that admins run every day. The signal is in the configuration — the presence of high-value saved credentials — not in the tooling.

Hardening and audit steps

1. Block network credential saving. The GPO Network access: Do not allow storage of passwords and credentials for network authentication (registry HKLM\SYSTEM\CurrentControlSet\Control\Lsa\DisableDomainCreds = 1) stops new domain credentials from being saved.
2. Disable saved RDP credentials by policy. Use Do not allow passwords to be saved for Remote Desktop Connection so TERMSRV/* entries can't accumulate.
3. Ban runas /savecred. Treat any saved-credential admin entry as a finding; it defeats least privilege entirely.
4. Purge existing entries. Inventory with cmdkey /list, then remove risky ones with cmdkey /delete:TERMSRV/dc01.
5. Prefer just-in-time access over saved credentials — Windows Hello for Business, smart cards, or a PAM/jump-host model that never persists a reusable secret on the endpoint.

Where WinSentinel fits

WinSentinel audits the Credential Manager attack surface as part of its credential-exposure checks: it flags stored TERMSRV/* and domain credential entries, verifies DisableDomainCreds and the RDP password-save policy, and surfaces runas /savecred saved admin credentials — the configuration signal that endpoint tooling misses. This runs at full strength on a single machine for free: all 33 audit modules, no limits, no account required. Point it at a workstation and you get the complete stored-credential inventory in one pass.

For teams running more than one box, WinSentinel Pro rolls those same findings up across the fleet from a central node — so you can answer "which of our 200 endpoints still have a saved DC credential?" in one query, watch for drift when a new risky entry appears, and enforce the hardening policies above as fleet-wide baselines. The single-machine audit is the same either way; Pro is what turns it into org-wide orchestration.

LSASS gets all the attention, but the credentials a user saved "to be convenient" are often the shortest path to the domain controller. Audit the vault, kill the saved secrets, and prefer credentials that can't be reused.