I have a security audit coming up and I'm working on some tasks before they arrive. One thing they always seem to get us on is the locally cached credentials on our workstations. We've locked them down fairly well but its still possible they may gain access to a domain machine. I've enabled the following group policy setting:
Computer\Windows\Security Settings\Local Policies\Security Options\Network Access: Do not allow storage of passwords and credentials for network authentication
I know its being applied as I can see a related message in the Windows credentials manager on my workstations. The problem is that any credentials that were already stored are still there which is normal behavior for this GP setting.
I need to find a way to delete all of the locally cached credentials, preferably without having to visit each workstation. Is there a method I can use with group policy or some kind of script that would accomplish this?