Check SYSVOL

Logon scripts and Groups.xml can contain creds or GPP passwords.

Browse the SYSVOL share for logon scripts and Group Policy Preference files. A hit is a cpassword in Groups.xml (AES-decryptable) or hardcoded credentials in a script.