I have a PC running Windows 7, and use domain profiles for login.
The group policies are set to remember the last user who logged on.
The problem I am having is that the login screen always shows username "xx001", when the last user was "yy001". User "xx001" has left the company a month ago.
Is there way to flush out the previous users on a PC, or is there a setting somewhere that overrides what it considers to be the 'last' user?
Thanks
Best Answer
Yes, to both.
The cached login credentials are stored in the registry, under:
HKLM\Security\Cache
, and are numberedN1$
,N2$
,N3$
, etc. If you were feeling bold, you could certainly delete those entries, or zero them out. To zero them out, use the following hex value (and note that it's not all0
's - there's an04
and an01
in there):Disclaimer: these entries control more than just cached domain logins, and directly editing or deleting them is not an advisable way to flush this cache, though taking a peek at what's in there might be useful. Keep reading for a better way to flush these records.
The number of cached users is controlled by the key at
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Current Version\Winlogon\
, which is aREG_SZ
data type, with a value between 0 and 50. The advisable way to flush this cache is to set this value to 0, reboot, log back in, and then set it to... something else and reboot again. The cache will be cleared, and the system will remember how ever many logins you set it to.Note that a low value, such as
1
, will probably cause problems with logging on offline, so bear that in mind if logging in offline is an applicable functionality here.And, for the sake of completeness, if you can still use the old user account, running the
Key Manager
dialogue under that account's user context on the computer in question will give you a GUI you can use to clear cached credentials. It includes credential types other than login credentials, but you can find the login credentials in it. You can get it through the control Panel, somehow, or run the following from a cmd or PowerShell prompt:rundll32.exe keymgr.dll, KRShowKeyMgr
. It looks like: