Skip to main content

​
Overview

The triage command is a comprehensive wrapper that executes all user DPAPI extraction commands in a single run. It automatically triages credentials, vaults, RDG files, and certificates for all accessible users on the system.
This is the recommended starting point for user DPAPI triage. It runs the equivalent of credentials, vaults, rdg, and certificates commands.

​
Basic Usage

​
Command Arguments

​
Decryption Methods

​
Targeting Options

When using /server, you must also supply either /pvk or /password for decryption.

​
What Gets Triaged

The triage command executes the following operations:
1

Credential Manager Credentials

Searches %LOCALAPPDATA%\Microsoft\Credentials\ for all users and decrypts credential files
2

Windows Vaults

Searches %LOCALAPPDATA%\Microsoft\Vault\ folders and decrypts vault data (browser passwords, etc.)
3

RDP Passwords

Searches for RDCMan.settings and .rdg files containing saved RDP connection passwords
4

User Certificates

Searches %APPDATA%\Microsoft\Crypto\RSA\ for user certificate private keys

​
Execution Context

When run with administrative privileges:
  • Triages all users on the system
  • Accesses all user profile directories
  • Maximum data collection

​
Example Output

​
Common Scenarios

After obtaining domain admin and retrieving the backup key:
Using Mimikatz-extracted masterkeys:
When you have a specific user’s credentials:

​
Detection Considerations

The triage command generates significant host activity that can be detected.
Detection Indicators:
  • Bulk access to multiple users’ DPAPI directories
  • Reading of Credential Manager files
  • Access to Vault folders across user profiles
  • Enumeration of certificate stores
  • Potential LSASS access (if masterkeys are extracted)
Defensive Monitoring:
  • Monitor bulk access to %LOCALAPPDATA%\Microsoft\Credentials\
  • Alert on access to %LOCALAPPDATA%\Microsoft\Vault\
  • Track certificate private key file access
  • Monitor for process accessing multiple user profiles
  • Detect non-standard processes reading DPAPI protected data

credentials

Decrypt only Credential Manager credentials

vaults

Decrypt only Windows Vault data

rdg

Decrypt only RDP connection passwords

certificates

Decrypt only certificate private keys

machinetriage

Triage machine/SYSTEM DPAPI data

backupkey

Retrieve domain DPAPI backup key

​
Tips

  • Use /mkfile instead of inline masterkeys for better performance
  • Target specific users when possible instead of triaging all users
  • Use individual commands (credentials, vaults) if you only need specific data types
  • Run without elevation to only triage current user (less noisy)
  • Use /unprotect for RDG files when possible (no masterkeys needed)
  • Target specific remote systems instead of broad sweeps
  • Redirect output to file with /consoleoutfile to minimize artifacts
No data decrypted:
  • Verify decryption method is correct (pvk, password, masterkeys)
  • Check if DPAPI data actually exists for target users
  • Ensure proper permissions to read user profile directories
Access denied errors:
  • Elevate to Administrator for multi-user triage
  • Verify remote admin access for /server operations
  • Check if target files are locked or in use