Section 7: Credential Manager

The Big Picture: The Key Cabinet

Every day you meet more locked doors: a shared folder on a home server, a remote desktop, a website, a mapped network drive. If you had to type the password every time, you would get tired and tempted to use short, easy passwords.

Windows offers a key cabinet with a lock on it. You put your keys (saved sign-ins) inside once, and Windows takes the right one out when a door asks. The cabinet is called Credential Manager.

What it is: Credential Manager is a built-in Windows feature that saves credentials (user name plus password or other secret) for you and hands them to programs that need them, so you do not need to type them again.

7.1 Stored Credentials for Websites and Network Resources

Credential Manager keeps credentials in two groups (you will see these two tabs in the Control Panel):

Within Windows Credentials there are a few kinds:

How it helps in real life:

 You open  \\NAS\photos   (first time)
    ▼
 Windows asks for user name + password
    ▼
 You tick "Remember my credentials"
    ▼
 Credential Manager saves it
    ▼
 Next time: Windows quietly sends the saved sign-in. No prompt.

How to see and manage them:

1. Control Panel → Credential Manager (or press Win, type "Credential Manager").
2. Pick Web Credentials or Windows Credentials.
3. Click an entry's arrow to see its details. You can Edit or Remove it.

Command line (read-only):

cmdkey /list

This lists the names of saved credentials (targets and user names). It does not show passwords. Your own PC may show items such as MicrosoftAccount:... or sign-in tokens for Microsoft apps. This is normal.

Hedge: the exact entries depend on which apps you use and on your Windows version.

Common uses and their problems:

Safety note: Convenience has a price. Anyone who sits at your unlocked, signed-in PC can use what you saved. Always lock the PC (Win + L) when leaving it.

7.2 Credential Vaults

What it is: A vault is the protected storage behind Credential Manager. Windows does not write your saved passwords in a plain file. They are encrypted and stored in your own user profile, in folders such as C:\Users\<you>\AppData\Local\Microsoft\Credentials and ...\Vault (hidden system folders). Do not open or edit these by hand.

What protects them? DPAPI. The Data Protection API (DPAPI) is a Windows service that encrypts data using a key derived from your sign-in. In plain words: your saved passwords are locked with a key tied to your Windows login. So:

• Another user on the same PC cannot read your vault.
• If the files are copied to another PC, they cannot be opened there.
• When you are signed in as yourself, Windows can unlock the items for you automatically, without prompting.

 saved password ──► DPAPI encrypts ──► vault file on disk
                       ▲
                key tied to YOUR sign-in
                (not stored in the file)

Roaming and syncing. Some secrets also appear in the vault because of your Microsoft account (for example, some app sign-in tokens). Hedge: what syncs and what does not depends on settings and apps.

Limits to remember:

Good habits:

• Remove old entries for resources you no longer use.
• Use Windows Hello or a strong password for your own Windows sign-in, since it guards the whole vault.
• Do not store credentials for shared or public PCs.

Ties to the rest of the chapter: the vault gives credentials to Windows when a resource asks for authentication. Then NTLM or Kerberos (Section 6) take over and prove your identity to that server, just as if you had typed the password by hand.

Summary