Link to home
Get AccessLog in
GST-GRIDTECHFlag for United States of America

asked on

IE 9 Cached credentials disappear on specific day of the week


I've been having a particularly annoying issue for more than 8 months now and was hoping someone could help point me towards a cause / solution.

It seems every THURDAY one of my users many web page cached credentials seems to be wiped out / removed / disappear and they then have to hunt around for the piece of paper where they think they may have wrote the user names/passwords.

Could someone give me some advice as to why this may happen?
This is a Corp, Windows 7, environment, but our IT dept in Corp HQ swears they aren’t doing ANYTHING that would clear a users cached credentials to web pages, but yet it happens, lock clock, work every THURSDAY???? I know it could be a lot of things, but I need to prove it’s a specific cause and eliminate that cause, so your help would be greatly appreciated.. Please help. Part of the problem is my Corp HQ IT dept is unwilling or unable to help me as they don’t see this as an issue, but my user does see it as a major issue…

Thank you
Avatar of Pramod Ubhe
Pramod Ubhe
Flag of India image

I have started using FireFox due to this issue.
I had that issue with Experts-Exchange and I allowed the EE Cookie in Symantec Endpoint Protection as an exception. That alleviated the situation, although it still happens occasionally (two computers plus my iPhone which is Safari).

So the web site itself may be an issue.

Next, on one problem computer, do an IE Reset to bring IE back to out-of-the box condition.
Open IE, Tools, Internet Options, Advanced and click on Reset. This will clear cookies, forms and temp file, so when you do this, the user's cached credentials will disappear. Have them start again and see if this corrects the issue.

... Thinkpads_User


I need to figure out whats causing it first.
What would have the ability to clear cached credentials, for MOST or all of the web pages?
Were are cached credentials maintained, can i back them up and restore.

problem with resetting IE  IS, I would be causing for the users, the very thing they are trying to avoid, wipping ALL of there credentials. i need to find out where there maintained, if i can back them up and what could wipe them out so i can try to prevent that, i shouldnt have to go to safari, IE is the Corp standard an only 1 and sometime 2 people are having the issue.

need to figure out the problem/cause....root cause analysis,

and thank you very much for your comments, thoughts and suggestions...
You cannot back up or restore cached credentials. However, if something has gone wrong with them, Reset is what fixes it. I have to reset IE myself on occasion. I have never been able determine why one or two go bad, and I had to use a cookie manager to find my problem with the EE site.

I suggest you try a Reset with one user to determine if it solves the problem. To repeat, you cannot restore cached credentials from a backup.

... Thinkpads_User
IE Passwords are saved in “Microsoft Protected Storage”


AutoComplete [ref 2] and Password Manager [ref 3] are the features that store web form usernames, passwords, and URLs for Internet Explorer

And these are kept in:

Encrypted usernames and passwords:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\SPW

Web addresses:
HKEY_LOCAL_MACHINE\Software\MicrosoftProtected Storage System Provider\Cryptographic symmetric keys: [ref 9]

HKEY_CURRENT_USER\Software\Microsoft\ Protected Storage System Provider\Data\\On Internet Explorer 7, AutoComplete information is stored in the Registry as well but in a slightly different location.

Encrypted Usernames and Passwords: [ref 10]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2

Then My question is, what could change “Microsoft Protected Storage” to include the registry links mentioned, How could I track when, where, what and how it was change so I can figure out what I need to prevent to keep it from it from being changed…

could this be some sort of group policy that my IT HQ could be sending down, but then i would need to figure out why only this one user and occasionaly 2 usrs are affected.

i can say that, over the 8 months, the main user with is issue has been given a new pc, only to later have the isseue return after about 3 weeks, but that was some time ago.

the below is just as a reference....

thank you for your input in helping with root cause analysis on this issue...

Also, my issue isn't that 1 or 2 occationaly go bad,
My issuse is, on a specific day, every Thursday, they ALL or most get wipped out,
like clock work....
I know the credentials are stored, but you cannot restore them.

every Thursday, they ALL or most get wiped out,  like clock work

I have not run across this (myself and all my clients).

Likely suspect in my mind:  The Antivirus suite you are using may be doing this.

... Thinkpads_User
we use Sophos, but i've even tried disabling sophos, the night before, onlt to find, that on THURSDAY, the credentials were still wipped out, so im sure its not the anti-virus, im thinking it may be some sort of group policy, but im not good with group policy.

i need to figure out WHAt's changing the PC from 4:30pm with the user goes home to about 4:30am when the user unlocks his computer and goes to his web sites.

The only think i havn't done yet is shutting the PC down the night before....
but still need to figure out a way to determine whats changing the PC between 4:30 pm till about 4:30 am....every thursday.......
Go to web site: and download Cookie View. It does not really install but it creates a config file. Put iecv.exe in a folder and run it. See if something jumps out (lots of cookies) for a suspect web site.

Perhaps run it at 4:15pm and make notes and then run again in the morning.

I think it must be environment related as I do not think it is an IE fault per se.

... Thinkpads_User
ok.. i'll give tath a try, later today....
thinkpads_user, gave QV a run last night and this morning. didn't see anything unusual.
of course the time to run will be next wednesday night /thurday morning, but i'll probably shut the machine down Wednesday night to prevent the Thursdsay morning wipeout.....
this is what i think could be getting wiped out..?

looking to install some sort of system monitor, over night, that can
ID if/when a change is made, possibly to the registry....??
Flag of United States of America image

Link to home
This content is only available to members.
To access this content, you must be a member of Experts Exchange.
Get Access
Ccleaner was the solution..