Avatar of GST-GRIDTECH
GST-GRIDTECH
Flag for United States of America asked on

IE 9 Cached credentials disappear on specific day of the week

Hi,

I've been having a particularly annoying issue for more than 8 months now and was hoping someone could help point me towards a cause / solution.


It seems every THURDAY one of my users many web page cached credentials seems to be wiped out / removed / disappear and they then have to hunt around for the piece of paper where they think they may have wrote the user names/passwords.


Could someone give me some advice as to why this may happen?
This is a Corp, Windows 7, environment, but our IT dept in Corp HQ swears they aren’t doing ANYTHING that would clear a users cached credentials to web pages, but yet it happens, lock clock, work every THURSDAY???? I know it could be a lot of things, but I need to prove it’s a specific cause and eliminate that cause, so your help would be greatly appreciated.. Please help. Part of the problem is my Corp HQ IT dept is unwilling or unable to help me as they don’t see this as an issue, but my user does see it as a major issue…


Thank you
Web BrowsersWindows 7PC

Avatar of undefined
Last Comment
GST-GRIDTECH

8/22/2022 - Mon
Pramod Ubhe

I have started using FireFox due to this issue.
John

I had that issue with Experts-Exchange and I allowed the EE Cookie in Symantec Endpoint Protection as an exception. That alleviated the situation, although it still happens occasionally (two computers plus my iPhone which is Safari).

So the web site itself may be an issue.

Next, on one problem computer, do an IE Reset to bring IE back to out-of-the box condition.
Open IE, Tools, Internet Options, Advanced and click on Reset. This will clear cookies, forms and temp file, so when you do this, the user's cached credentials will disappear. Have them start again and see if this corrects the issue.

... Thinkpads_User
GST-GRIDTECH

ASKER
I need to figure out whats causing it first.
What would have the ability to clear cached credentials, for MOST or all of the web pages?
Were are cached credentials maintained, can i back them up and restore.

problem with resetting IE  IS, I would be causing for the users, the very thing they are trying to avoid, wipping ALL of there credentials. i need to find out where there maintained, if i can back them up and what could wipe them out so i can try to prevent that, i shouldnt have to go to safari, IE is the Corp standard an only 1 and sometime 2 people are having the issue.

need to figure out the problem/cause....root cause analysis,

and thank you very much for your comments, thoughts and suggestions...
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy
John

You cannot back up or restore cached credentials. However, if something has gone wrong with them, Reset is what fixes it. I have to reset IE myself on occasion. I have never been able determine why one or two go bad, and I had to use a cookie manager to find my problem with the EE site.

I suggest you try a Reset with one user to determine if it solves the problem. To repeat, you cannot restore cached credentials from a backup.

... Thinkpads_User
GST-GRIDTECH

ASKER
If,
IE Passwords are saved in “Microsoft Protected Storage”

And

AutoComplete [ref 2] and Password Manager [ref 3] are the features that store web form usernames, passwords, and URLs for Internet Explorer

And these are kept in:

Encrypted usernames and passwords:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\SPW

Web addresses:
HKEY_LOCAL_MACHINE\Software\MicrosoftProtected Storage System Provider\Cryptographic symmetric keys: [ref 9]

HKEY_CURRENT_USER\Software\Microsoft\ Protected Storage System Provider\Data\\On Internet Explorer 7, AutoComplete information is stored in the Registry as well but in a slightly different location.


Encrypted Usernames and Passwords: [ref 10]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2

Then My question is, what could change “Microsoft Protected Storage” to include the registry links mentioned, How could I track when, where, what and how it was change so I can figure out what I need to prevent to keep it from it from being changed…

could this be some sort of group policy that my IT HQ could be sending down, but then i would need to figure out why only this one user and occasionaly 2 usrs are affected.

i can say that, over the 8 months, the main user with is issue has been given a new pc, only to later have the isseue return after about 3 weeks, but that was some time ago.

the below is just as a reference....
http://www.techrepublic.com/forum/questions/101-235623/where-are-ie-passwords-cached

http://www.symantec.com/connect/articles/password-management-concerns-ie-and-firefox-part-one


thank you for your input in helping with root cause analysis on this issue...

Also, my issue isn't that 1 or 2 occationaly go bad,
My issuse is, on a specific day, every Thursday, they ALL or most get wipped out,
like clock work....
John

I know the credentials are stored, but you cannot restore them.

every Thursday, they ALL or most get wiped out,  like clock work

I have not run across this (myself and all my clients).

Likely suspect in my mind:  The Antivirus suite you are using may be doing this.

... Thinkpads_User
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
GST-GRIDTECH

ASKER
we use Sophos, but i've even tried disabling sophos, the night before, onlt to find, that on THURSDAY, the credentials were still wipped out, so im sure its not the anti-virus, im thinking it may be some sort of group policy, but im not good with group policy.

i need to figure out WHAt's changing the PC from 4:30pm with the user goes home to about 4:30am when the user unlocks his computer and goes to his web sites.

The only think i havn't done yet is shutting the PC down the night before....
but still need to figure out a way to determine whats changing the PC between 4:30 pm till about 4:30 am....every thursday.......
John

Go to web site: http://www.nirsoft.net and download Cookie View. It does not really install but it creates a config file. Put iecv.exe in a folder and run it. See if something jumps out (lots of cookies) for a suspect web site.

Perhaps run it at 4:15pm and make notes and then run again in the morning.

I think it must be environment related as I do not think it is an IE fault per se.

... Thinkpads_User
GST-GRIDTECH

ASKER
ok.. i'll give tath a try, later today....
Your help has saved me hundreds of hours of internet surfing.
fblack61
GST-GRIDTECH

ASKER
hi,
thinkpads_user, gave QV a run last night and this morning. didn't see anything unusual.
of course the time to run will be next wednesday night /thurday morning, but i'll probably shut the machine down Wednesday night to prevent the Thursdsay morning wipeout.....
GST-GRIDTECH

ASKER
this is what i think could be getting wiped out..?

looking to install some sort of system monitor, over night, that can
ID if/when a change is made, possibly to the registry....??
IE-Autocomplete-forms-setting.JPG
ASKER CERTIFIED SOLUTION
GST-GRIDTECH

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
GST-GRIDTECH

ASKER
Ccleaner was the solution..
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.