How do I emulate the extraction of cleartext passwords for the Scheduled Task LogonType password misconfigurations?

Question

Microsoft Recommendation for configuration of Scheduled Task is "In the new task, if the Task Content: XML contains <LogonType>Password</LogonType> value, trigger an alert. In this case, the password for the account that will be used to run the scheduled task will be saved in Credential Manager in cleartext format, and can be extracted using Administrative privileges."

Anyone knows how to validate/emulate that such a setting can lead to the cleartext password being leaked to an admin account?

I have attempted the following:

1. In a VM, created admin and normal user accounts. Using normal user account, create the scheduled task with the LogonType Password and trigger the scheduled task. Change to using admin account and access Credential Manager > Windows Credentials. Attempted to view cleartext password of the normal user account but to no avail.
2. In an Active Directory, created Domain Admin and Doimain User accounts. Using Domain User account, create the scheduled task with the LogonType Password and trigger the scheduled task. Change to using Domain Admin account and access Credential Manager > Windows Credentials. Attempted to view cleartext password of the normal user account but to no avail.