Where can I find out how long cached credentials last in active directory
I have a user that will be outside of the network for a bit of time so he will not be able to connect to the domain to refresh his cached login credentials, where can I look to see the current length of time that the credentials will last before they expire? Also how can I change the length of time that credentials last?
Active DirectoryWindows XPWindows Networking
Last Comment
tigermatt
8/22/2022 - Mon
tigermatt
As far as I am aware, the cached credentials stored on any workstation will not expire. They will remain there indefinitely, no matter whether the station will be contacting the domain or not.
You CAN set the number of cached credentials a workstation will store, but unless you know you have changed this option, it should be set to the default and allow the user to store their cached credentials.
As always, remove the computer from the domain and cease all network connections, then just verify the user can log-in using cached credentials before they set off.
-tigermatt
Rob Williams
Agree, there is no limit as to how long you can use cached domain credentials, even if the password has expired on the domain. I have a couple of clients, that have been using the same cached credentials for 15 months now, much to my frustration ;-)
There is a default limit of 10 saved credentials, but I believe that can be increased to a maximum of 50.
knada242
ASKER
That is good info to know. This domain, and many of it's policies were created by a former administrator. I would like to verify this, where is the setting located in group policy?
You can't verify that setting because it because no setting exists.
You can create a new sub keys or edit in the following registry key to disable caching all together or set the maximum number of credentials saved.
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
You CAN set the number of cached credentials a workstation will store, but unless you know you have changed this option, it should be set to the default and allow the user to store their cached credentials.
As always, remove the computer from the domain and cease all network connections, then just verify the user can log-in using cached credentials before they set off.
-tigermatt