Windows Credential guard does not prevent using encrypted Kerberos keys to change a user's password leading to elevation of privilege. Continue reading...