In my environment we have powershell remoting off- I get around this using 2 hop scripts, packages(exe -no creds are stored in code- local privs only), and iwmi. I never pass creds to the endpoint, only use it to auth to the endpoint. I use heightened accounts to parse logs, manage configs, etc on endpoints. Since my account technically logs in every WMI hit it makes (visible in the event log) does this also mean that creds passed with WMI and powershell are stored in lsass and potentially visible to procdump or mimikatz like module/framework?
Thanks so much for any insight or thoughts into this!