Running KeyMgr.dll remotely

As many other people have complained, we've had problems with people saving credentials when they connect through a proxy server, and then their accounts get locked out weeks later when they change their password.
We have proven that this problem can be solved by accessing KeyMgr.dll and deleting any of the saved credentials.

We have users who touch literally 100's of computers in a month, and so when their account gets locked out, trying to track down which computers they might have touched, and then log into each individually and clear the credentials by hand is an arduous task.

Question:  Is there a way to do the equivalent of running KeyMgr.dll and deleting ALL saved credentials, but to do this remotely (or even better: via batch) to computers remotely?
LVL 1
TomProAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

RobSampsonCommented:
Hi, add this to a logon script:
cmdkey /delete:<proxyserveraddress>

or to remove all saved credentials:
cmdkey /delete:*

This way, when anyone logs on, their credentials will be removed.  If you are not sure whether systems have cmdkey on them, copy it to a network location, and use
\\server\share\cmdkey /delete:<proxyserveraddress>

Regards,

Rob.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
TomProAuthor Commented:
I like the solution of using CmdKey and will do some testing.  

Is there a way to run the /list version remotely?  For instance:  Can I create a batch that runs on the AD that would query each of the domain members one by one and return the results of a CmdKey /list for each?
I want to add the script with the delete/*, but I'd like to be able to check all of the systems before I implement the script to make sure that I'm not deleting something that should really still be there, and with some 1000 member servers, it'll take forever for me to log into each one at a time to check their listings.
RobSampsonCommented:
Hi, you can, with PSExec, but the output's not too clean.  You'd need to parse it further.  If you copy cmdkey to a network share, you can direct PSExec to run it from there, and then store the cmdkey output in another shared folder:

C:\Tools\psexec -accepteula -u domain\administrator -p password \\REMOTEPC cmd /c \\server\share\cmdkey /list > \\server\share\CmdKey\cmdkeyoutput.txt

Or you could just use this in a logon script
cmdkey /delete:<proxyserveraddress>

so that you only affect the credentials for that one resource.

Regards,

Rob.
TomProAuthor Commented:
RobSampson had it right.  Thanks VERY much for all your help.  I apologize for the delay in closing.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows OS

From novice to tech pro — start learning today.