Clearing cached domain credentials

Question

For security purposes I am currently overlooking our procedure regarding use of domain admin accounts and the credential storage on our workstations.

I will be creating an account used solely for connecting a computer to the domain in the future so that issue is taken care of.

The issue I have is that we have a whole lot of workstations where our admin accounts have already been used and therefore the credentials are already cached.

I have tried googling for answers, asking chatgpt etc and all I get is incorrect information about where this is stored or how I can access it.

I do not have a SAM folder under C:/Windows/System32
The HKLM/Security is empty
Credential Manager on control panel does not store these credentials.

I just want to stress that I do not want a suggestion such as setting the interactive logons to 0 because that doesn't solve my issue with the already stored credentials which I want to clear.

I tried simply removing the user profile but offline logon still worked

I appreciate all help I can get, I'm about to pull my hair out trying to solve this issue.

Answer 1

Hi Robin,

Thanks for your post. You could modify the registry of the system to disable cached logon credentials. Set the registry key to 0. This will require a reboot after each change. This also assumes you don't have a GPO that sets this key.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Current Version\Winlogon\

ValueName: CachedLogonsCount

Data Type: REG_SZ

Values: 0 - 50

Best Regards,

Ian Xue

---

If the Answer is helpful, please click "Accept Answer" and upvote it.