Did you know that Scheduled Tasks stored credentials in the SYSTEM Credential Store? Did you also knew that even when you delete a Scheduled Task they remain there? ;)pic.twitter.com/4ptG66LuPL
Maybe dumb question, are there any other way it could have been done? Maybe instead of storing credentials just get token from services4u , use privelegies to impersonate, then spawn new process as user ... I guess that would work for any not service account.