I have a security audit coming up and I'm working on some tasks before they arrive. One thing they always seem to get us on is the locally cached credentials on our workstations. We've locked them down fairly well but its still possible they may gain access to a domain machine. I've enabled the following group policy setting:
Computer\Windows\Security Settings\Local Policies\Security Options\Network Access: Do not allow storage of passwords and credentials for network authentication
I know its being applied as I can see a related message in the Windows credentials manager on my workstations. The problem is that any credentials that were already stored are still there which is normal behavior for this GP setting.
I need to find a way to delete all of the locally cached credentials, preferably without having to visit each workstation. Is there a method I can use with group policy or some kind of script that would accomplish this?
The average business loses $13.5M per year to ineffective training (per 1,000 employees). Keep ahead of the competition and combine in-person quality with online cost and flexibility by training with Linux Academy.
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012.
Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …