Hi,
I'm trying to find out if there is any way to delete the domain account login credentials that Windows XP caches. I understand that the default is up to 10 previous login account details are cached.
I don't want to turn off caching, and know that this can be done using Group Policy.
However we have a lot of laptops that have in the past been logged onto with the Domain Administrator account, and in the interests of security, I'd like to remove the Domain Administrator account details from the cache of our laptops. We only have a few so this can be a manual process if required...
My question is therefore how to do this:
- Manually edit registry? How?
- Flush all cached credentials? How?
- Use a utility - any suggestions?
Suggestions welcome!
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Hmm... I don't have a way to test this right now, but this earlier thread:
http://www.experts-exchang
implies that the suggestion by KCTS should work.
A quicker way to reach the same place:
Start -> Run -> rundll32.exe keymgr.dll, KRShowKeyMgr -> OK
Actually that was KCTS who suggested that (and he is usually right). To see if the problem is that you don't have System level access, you can use the method suggested in this link to login as "System" then run Regedit:
http://www.askstudent.com/
Yes, I like it too :)
This isn't much of an exploit any more, since these days access to the AT command is restricted to Administrators, but it can be handy when you need access as the "system" user (or more correctly, "Local System"). Also, it is not true that System has more access than Administrator, just to some things. Administrator can do other things that System cannot. Interestingly, on Vista, even Administrators are denied access to the AT command, though I'm sure there is a workaround somewhere.
A further point for anyone who tries this solution.
Firstly to view the cache registry entries, you need to launch regedit as system.
Log on as an admin, load up a command prompt and type:
at xx:xx /interactive "regedit.exe"
where xx:xx is a time a few minutes in the future. at that time regedit will launch under the system account. you can then go to HKEY_LOCAL_MACHINE\SECURIT
To remove the cached credentials DO NOT delete the values NL$1 through NL$10 as Windows will not cache any credentials at all! Also DO NOT delete the NLControl value. I learnt this the hard way! Instead simply overwrite the data in NL$1 to 10 with zeroes.
Business Accounts
Answer for Membership
by: KCTSPosted on 2007-05-27 at 09:29:04ID: 19164635
The Start>Run>control userpasswords2>Advanced>Ma