MCITP MCSE Boot Camp

Understanding password caching

Domain credentials

Generic credentials

Credential Manager

Functionality that cached domain credentials provide

• Single Sign-On
  Single Sign-On (SSO) uses the credentials that are collected during an interactive domain logon to let the user authenticate to a network one time. Thereafter, the user has access to all the authorized network resources without providing credentials again. These network resources may range from hardware devices to programs, files, and other types of data. All these resources may be spread throughout an enterprise on servers of various types. The resources may be in different domains or may be on different operating systems.
• Access to machine resources when a domain controller is unavailable
  After a successful domain logon, a form of the logon information is cached. Later, a user can log on to the computer by using the domain account, even if the domain controller that authenticated the user is unavailable. Because the user has already been authenticated, Windows uses the cached credentials to log the user on locally. For example, suppose a mobile user uses a domain account to log on to a laptop that is joined to a domain. Then, the user takes the laptop to a location where the domain is unavailable. In this scenario, Windows uses the cached credentials from the last logon to log the user on locally and to allocate access to local computer resources.

Security of cached domain credentials

• A precompiled table must be created for each salt.
• The verifier cannot be used to log on anywhere else.

Configuration options for cached domain credentials

• Number of cached domain credentials stored on the client
  By default, the operating system caches the verifier for each unique user's ten most recent valid logons. This value can be set to any value between 0 and 50. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
  172931 Cached domain logon information
• Notification of logon using cached domain credentials
  When you try to log on to a domain from a Windows-based client computer, and a domain controller is unavailable, you do not receive an error message. Therefore, you may not notice that you logged in with cached domain credentials. For more information about how to display a message when you use cached credentials to log on, click the following article number to view the article in the Microsoft Knowledge Base:
  242536 User is not alerted when logging on with domain cached credentials

Security considerations for cached domain credentials

Deleting the credential cache