passwords via DPAPI cracking?
In the "DPAPI Secrets. Security analysis and data recovery in DPAPI" page over on

there is a section near the end titled:
"Recovering user password without loading hashes from SAM/NTDS.DIT"

whose last paragraph reads:

[. . .] the recovery of user's password from the Master Key is not of any practical benefit. For example, in Windows 7, the password validation goes at the speed of about 10 p/s. Theoretically, the speed can be increased by a few orders of magnitude by optimizing the encryption algorithms and engaging GPU in the validation. [. . .]

Has this ever been on the goals list for oclHashcat?
No clue what DPAPI is