DPAPI is a core Windows component designed to protect sensitive data by encrypting it using the user's logon credentials or the system's identity. It eliminates the need for applications to manage their own encryption keys.

Data Protected by DPAPI

• Wireless Credentials: WPA2/WPA3 Wi‑Fi profile passwords.
• Web Browsers: Chromium-based browsers (Chrome, Edge) use DPAPI to protect the "Local State" and "Login Data" keys.
• RDP: Saved passwords for Remote Desktop connections.
• EFS: Encrypting File System keys.
• Outlook: Mail account passwords and profiles.

Key Hierarchy and Storage

DPAPI relies on a multi-layered key hierarchy to ensure that data remains inaccessible even if the physical disk is stolen.

Master Keys (The Root of Trust)

Master Keys are 64-byte random values used to protect the "Session Keys" that actually encrypt the data. They are renewed every 90 days by default.

• User Master Key (UMK):
  • Bound to a specific Windows user.
  • Storage: %APPDATA%\Microsoft\Protect\<UserSID>\
  • The filename is a GUID, which is referenced in the DPAPI BLOB.
• System Master Key (SMK):
  • Bound to the local machine (used by services/SYSTEM).
  • Storage: C:\Windows\System32\Microsoft\Protect\S-1-5-18\
  • Registry Backup: HKLM\SECURITY\Policy\Secrets\$DPAPI_SYSTEM

The Local Security Authority (LSA)

The LSASS (lsass.exe) process manages DPAPI keys in memory. When a user logs in, LSA decrypts the Master Key and keeps it in memory so that the user doesn't have to provide their password every time an application requests data decryption.

Mock-up of LSA Memory (Readable Format):

LSA DPAPI Cache

• MasterKey GUID: {A1B2C3D4-E5F6...}
• Status: Decrypted / Active
• Plaintext Key: 0x89ABCDEF... (64 bytes)
• Owner: DOMAIN\User