Credential Guard cached hash refresh after local account password expiration in Windows 11 22H2

Credential Guard isolates LSA secrets and retains credential hashes in memory for protected local accounts on Windows 11 22H2 Enterprise and Pro editions. The Maximum password age policy applies only to local accounts, while Microsoft account passwords never expire, creating an authentication boundary that is not fully documented.

It is unclear whether Credential Guard automatically replaces its cached hash when a local account password is changed or reaches its maximum age, or whether the original hash remains available until the next interactive logon. Administrators need to know if the cached credential continues to reflect the pre-expiration password after policy enforcement.

Does Credential Guard invalidate or update its cached hash automatically after a local account password change? Can administrators confirm that the in-memory credential matches the current password policy state for accounts configured with never expire?