Check for config and credential files

ad privescwindowschecklist

Walkthrough

Recurse user profile folders for documents and KeePass databases that may hold secrets. A hit is a password file, KDBX vault, or notes containing credentials.

Commands

powershell

Get-ChildItem -Path C:\users\ -include *.kdbx,*.txt,*.pdf,*.xls,*.doc -File -Recurse -ErrorAction SilentlyContinue