home Tech Disabling cached credentials in Vista

Disabling cached credentials in Vista

Windows Vista by default will remember/cache user credentials when it is in a domain based environment.Needless to say,this many counts can be a potential security risk in itself as cached logon or cached credentials allow users to logon and use Windows even when it is not actively connected to domain as a kind of work offline mode.

Now,ideally restricting cached logons for Windows clients is easier and much effective by defining a GPO (group policy object) that changes the cached logon value as desired,0 in case of really tight security policies so that no user can logon offline.

Open Registry editor (Start > Run > regedt32)

The registry hack that can change the cached logon counts is located in :
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon

Here,the string cachedlogonscount keeps a count of how many cached logons are allowed,simply change this value from default 10 to whatever is needed.
Save this string,exit registry editor and reboot once.

If this setting is propogated via a domain controller through GPO,make sure that after the policy is pushed,on the client side a gpupdate/force is done from the command prompt to ensure it is received.

Hope this has been an informative post.

Cheers.

Leave a Reply

Your email address will not be published. Required fields are marked *