Get-DecryptedObject is used by these commands:

• Copy-DbaLinkedServer in case -ExcludePassword is not used with a dedicated admin connection
• Export-DbaLinkedServer in case -ExcludePassword is not used with a dedicated admin connection
• Copy-DbaCredential in every case with a dedicated admin connection
• Export-DbaCredential in case -ExcludePassword is not used with a normal connection
• Copy-DbaDbMail in case there are mail server credentials with a normal connection

Only in the last two cases Get-DecryptedObject needs to open a local dedicated admin connection using Invoke-Command2.

We should remove this case entirely. Establishing a dedicated remote administrator connection to the source should be a prerequisite for all commands in the list. All commands in the list should get a parameter -ExcludePassword to avoid the dedicated admin connection.

Steps to do this:

• Change Export-DbaCredential the way we changed Export-DbaLinkedServer (Export-DbaCredential: Open DAC unless ExcludePassword used #10112)
• Change Copy-DbaCredential and add a parameter -ExcludePassword (Copy-DbaCredential: Add ExcludePassword #10115)
• Change Copy-DbaDbMail and add a parameter -ExcludePassword (Copy-DbaDbMail: App parameter ExcludePassword #10117)

The first two are easy, I can do that and test that.
But the last one is a bit more work so I want to get the ok to invest this.

@potatoqualitee / @niphlod - What do you think?

This is related to the change #10106 and my findings in test of #10101