Reviewing the CIS recommended hardening config for Windows Server. Just realized that you shouldn’t just look at the failed controls but the ones that passed too. One control when enabled actually passes command line entries into the audit log in plain text, so that includes passwords.