An attacker with local access can grab admin credentials from active memory prior to deletion.
Bill Brenner is the Senior Vice President of Audience Content Strategy at CyberRisk Alliance. With a background in web security and information security, Bill has extensive experience in writing and reporting on cyber threats, breaches, and security solutions. His work has been featured in SC Media, MSSP Alert, and ChannelE2E, among others.