Decryption error for credentialmanager

[mpgn]

Hello,

On a server 2025 i got this error:

dploot credentials -t 192.168.231.150 -u administrator -p October2022 -debug                                                                                                821ms  Wed 13 Aug 2025 11:24:29 AM CEST
dploot (https://github.com/zblurx/dploot) v3.1.2 by @_zblurx
[+] options=Namespace(action='credentials', mkfile=None, pvk=None, passwords=None, nthashes=None, target='192.168.231.150', domain=None, username='administrator', password='October2022', debug=True, quiet=False, export_dir=None, hashes=None, no_pass=False, k=False, aesKey=None, use_kcache=False, kdcHost=None, dc_ip=None, localroot='.')
[+] Connecting to 192.168.231.150
[+] Authenticating with administrator through NTLM
[*] Connected to 192.168.231.150 as \administrator (admin)

[*] Triage ALL USERS masterkeys

[+] Found MasterKey: \\192.168.231.150\C$\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-2999358954-817058777-1374132388-500\351a4cdf-df24-4c0c-b348-0b3f9eb36d97

[*] Triage Credentials for ALL USERS

[+] Found Credential Manager blob: \\192.168.231.150\C$\Users\Administrator\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D
[+] Could not decrypt...
[+] Found Credential Manager blob: \\192.168.231.150\C$\Users\Administrator\AppData\Roaming\Microsoft\Credentials\CC1FEFD22813F3E24648D9BA6C0B8526
[+] Could not decrypt...
[+] Found Credential Manager blob: \\192.168.231.150\C$\Users\Administrator\AppData\Roaming\Microsoft\Credentials\DFC9E3D7D8A90CF46FEA3787AD9FAAD9
[+] Could not decrypt...

[zblurx]

We "resolved" this on Discord but I want to document it publicly, in case anyone cross this weird issue :)

After a lot of testing, I found that users created before promoting the server to a domain controller (for example, RID 500 Administrator account, but also any account created before the promotion to DC) see their masterkeys re-encrypted during their first login on the server after the promotion to DC.

Any user created post promotion to DC does not reproduce the issue and their masterkeys can be decrypted as usual.

Something I did not managed to solve for now : for the accounts having this masterkey issue, somehow they can still decrypt the related DPAPI_BLOB, for example using the GUI like mpgn in the above screenshot... This mean that the masterkeys should be decryptable. As we say, Affaire à suivre