Domain Laptop Cached User Credentials randomly no longer usable

Daisy Zhou 20,791 Reputation points Microsoft Vendor
2020-08-07T07:47:37.82+00:00

These days, thanks to the pandemic, we have many users working on their laptops from home (connecting to the domain through VPN once they login). Extremely rarely (it's happened a handful of times in the past 3-4 months) we have a user who suddenly can't login to their domain account using cached credentials. My instinct tells me it is related to our Interactive Logon policy limiting cached credentials to 1 account total. It has happened once to one of our senior network admins who assures me he never logged in with any other account, so I am not sure how the cached credentials are being replaced. I have read all over the place that cached credentials never expire, so I know that isn't the issue.
I am not sure what to do besides recommending to my boss that we change our cached credentials policy to save 2 accounts instead of 1. Has anyone else worked through a similar problem?

Source: https://social.technet.microsoft.com/Forums/windowsserver/en-US/afd994c3-9f3f-4478-93cf-03fc40074271/domain-laptop-cached-user-credentials-randomly-no-longer-usable?forum=winserversecurity

Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,774 questions
0 comments
Accepted answer
  1. Hannah Xiong 6,256 Reputation points
    2020-08-07T07:52:10.58+00:00

    Hello,

    Thank you for posting in our TechNet forum.

    According to your description, we did not work through the similar problem. Logon information for domain accounts can be cached locally so that, if a domain controller cannot be contacted on subsequent logons, a user can still log on.

    It is suggested that we could change our cached credentials policy to save more accounts. The value of this policy setting indicates the number of users whose logon information the server caches locally. If the value is 10, the server caches logon information for 10 users. When an eleventh user logs on to the device, the server overwrites the oldest cached logon session.

    For more information, we could refer to:
    https://video2.skills-academy.com/en-us/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available

    For any question, please feel free to contact us.

    Best regards,
    Hannah Xiong

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest