Glossary
DPAPI
The Windows Data Protection API. Its machine-scope keys live in the SECURITY hive (DPAPI_SYSTEM) and can be recovered offline to decrypt system-protected secrets.
DPAPI (Data Protection API) is the Windows service that encrypts secrets on behalf of applications — saved credentials, browser cookies, Wi-Fi keys, certificates and more — using master keys derived from a user's password or from the machine itself.
The machine-scope master key is protected by the DPAPI_SYSTEM
LSA secret in the SECURITY hive. Because that
secret is recoverable offline from the SYSTEM + SECURITY hives (via the
boot key), an analyst with those hives can decrypt
machine-protected DPAPI blobs without the host being online. User-scope DPAPI
additionally needs the user's password or NT hash to unwrap their master key.