Solving the Frequent Credentials prompt in Outlook 2010 on a Windows 7 machine.

Help! My users are getting persistently prompted for the credentials while in Outlook.

Sound familiar? Ever since switching to Outlook 2010 running in cached mode on Windows 7 computers, we have been getting increased complaints from our domain users and our admins regarding users getting prompted repeatedly, at seemingly random intervals, for their credentials. The credentials in the popup are prepopulated, but if they hit enter, Outlook will just prompt again, and if they hit enter enough times, it will ultimately lock out their account. If they manually fill in the credentials with the correct information and then hit enter, it will let them in but the problem ultimately comes back later. If they hit cancel, Outlook forces them to work offline.

It seems like there are a million recommendations on what to do with this, but none of them seemed to address the actual issue. Well after much heartburn and hairloss, I have finally found what was causing the issue. Apparently, in Windows 7, you have something called a Windows Vault. To manage this vault, you use a ghost in the machine known as the Credential Manager. Within the vault are various types of stored credentials but the ones we are having issues with are under the Generic Credentials. This is a sort of cache pool for frequently used third party credentials. By third party, it means anything not a Windows logon. Things like Lync, Outlook, and even some websites (like ADP) can have their credentials automatically stored here. The problem comes in when the user account and/or the password in this cached copy do not match the user's actual user account and/or password.

What can I do to exorcise the ghost?

So what do you do about it? You have a couple of choices:

1. Fix the credentials in cache.

To do this, you will go to the Windows Control Panel, then click on User Accounts, and finally on Manage Your Credentials. From there you will see various types of stored credentials. Under Generic Credentials, you should see one or more sets of credentials with a name similar to MS.Outlook:username@domainname:Put.

Click on the credential to expand it. From here you have two choices; Edit or Remove from vault

If you choose to edit it, simply type in the correct username and/or password and click on save. Make sure you remove the additional Outlook entries as only one is needed and the others may cause conflicts. To prevent the user from accidentally typoing their credentials though, the best option is to simply delete all of the Outlook credentials from the vault and let Outlook recreate it at it's leisure. That way it is sure to have the most current username and/or password cached.

2. Recreate the user's outlook profile.

This may seem a bit extreme, but if you recreate their profile, it should no longer associate the cached credentials with the outlook profile and therefore won't conflict with it. This is obviously an alternate method for folks who have policies in place to lock down things like the Credential Manager, keeping you from being able to fix this issue using the above preferred method.

Where can I find out more about the Windows Vault

I found a short but informative article on the Windows Vault at the following url:
http://4sysops.com/archives/windows-vault-windows-stored-user-passwords

Hopefully others will find this information useful and my true goal of saving IT folks from early hair loss and complications from acid reflux can be one step closer to fruition.