Dump LSASS Memory from a Privileged Account Outside the Protected Users Group

Privileged user accounts that are not members of Protected Users do not receive that group's protections against credential caching and related authentication behaviors. If such an account has a logon session on a Windows host, an operator with authorized local administrative or SYSTEM access may attempt to dump LSASS and recover whatever credential material is present. The group limits some credential exposure but does not guarantee LSASS is credential-free or prevent every credential-theft method.