Cached hashes or credentials of users who have previously logged onto a machine (for example at the console or via RDP) can be read from the SAM by anyone who has Administrator-level privileges.
Dumping authenticated users' credentials stored by Windows in the memory of the lsass.exe