win10pwstore
Starting with 8.x and 10, by default, there is no password in memory.
Exceptions:
When DC is/are unreachable, the kerberos provider keeps passwords for future negocation ; When HKEY_LOCAL_MACHINE, UseLogonCredential (DWORD) is set to 1, the wdigest provider keeps passwords ; When values in Allow* in HKEY_LOCAL_MACHINEor HKEY_LOCAL_MACHINE, the tspkgs / CredSSP provider keeps passwords.
from https://github.com/gentilkiwi/mimikatz/issues/40#issuecomment-220830921
You can edit this reg key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest
change negotiate to 1
add UseLogonCredential DWORD 1
and then the password will show up in mimikatz et al