PowerSploit has several modules that search the Windows Registry for stored credentials: "Get-UnattendedInstallFile", "Get-Webconfig", "Get-ApplicationHost", "Get-SiteListPassword", "Get-CachedGPPPassword", and "Get-RegistryAutoLogon".