Related: How can I enable domain authentication over wireless in Windows 7/2k8?
To test the domain login over wireless connection feature I'm trying to set up in the above question, I need an account that hasn't had its domain credentials cached on the local system. Unfortunately, there's only so many people in my office who might help me test this, and even then I'd rather not bother them for it. So, I'd like to be able to clear my own cached credentials after each login.
How can I clear the local cache, while still retaining the ability to cache credentials in the future?
Best Answer
David Yu's answer is pretty much on-target, but there is a way to do this without editing the registry directly. Again though, this will only work if the setting is not configured by GPO.
First, I'd like to point out where the cached credential data is stored. This will help demonstrate (and, for troubleshooting purposes, verify) the effect of the configuration changes.
WARNING: I found this information in several places on the Internet, most of which recommended against modifying these values manually.
The registry key that stores cached domain logins is hidden even from Administrators. It is only accessible by the SYSTEM account. Therefore, to view it you will need a tool like
psexec(available from Microsoft, but not installed by default) which will allow you to runregeditas SYSTEM. The command line to do this (assuming it is installed, and in your%PATH%) is:psexec -d -i -s regeditOnce you're in there, navigate to
HKLM\SECURITY\Cache\. Here, you should see several BINARY values. There will be one named NL$Control, and others named NL$## for each slot that you have available for cached credentials. (Default 10)Again, I want to emphasize here that you should not manually modify or delete this key or its values.
So, now that we know where the data is cached, and that we should not touch it there, how do we clear it?
Again, David Yu's answer will point you to the right registry key. But, if you'd rather not modify the registry directly, there is another way to do this via the Local Security Policy.
secpol.mscIn the Security Settings tree, navigate to
Local Policies\Security Options. Here will be a policy calledInteractive logon: Number of previous logons to cache (in case domain controller is not available).By default this is set to
10 logons. To clear the cache, set it to zero and click OK. On Server 2008, this will take effect immediately. For Server 2003, you will need to reboot. The affect can be seen inHKLM\SECURITY\Cache\where there will no longer be any NL$## values.To re-enable credential caching, edit the same Policy to reflect your preferred value and hit OK. Again, if you're on Server 2008, this will take effect immediately. Server 2003 will require a reboot. Note that, if you are doing this on Server 2008 and you have not logged off or rebooted yet, you can see that the cache slots have been restored but no actual data is in them.
Doing this without logoff or reboot in Server 2008 can be useful if you want to just do a quick, one-time check of whatever function requires temporarily-disabled credential caching. It also helps ensure you don't forget to revert the change after your next login.