Replying in case you haven't already figured it out.
I only just began my own testing, so I've barely touched the surface, but one place where deceptive user and credentials could be placed is in the default user directory.
So, that would be C:\Users\Default\ - And within this dir a deceptive file with one or more deceptive usernames plus credentials would be.
If you press export when having selected the deception rule, you'll get a .csv with a few more details.
Hope this helps
