Does Windows 7 Authenticate Cached Credentials on Startup

Posted by Farray on Super User See other posts from Super User or by Farray
Published on 2011-04-15T16:29:04Z Indexed on 2011/11/29 1:54 UTC
Read the original article Hit count: 406

Problem

I have a Windows domain user account that gets automatically locked-out semi-regularly.

Troubleshooting Thus Far

The only rule on the domain that should automatically lock an account is too many failed login attempts.

I do not think anyone nefarious is trying to access my account. The problem started occurring after changing my password so I think it's a stored credential problem. Further to that, in the Event Viewer's System log I found Warnings from Security-Kerberos that says:

The password stored in Credential Manager is invalid. This might be caused by the user changing the password from this computer or a different computer. To resolve this error, open Credential Manager in Control Panel, and reenter the password for the credential mydomain\myuser.

I checked the Credential Manager and all it has are a few TERMSRV/servername credentials stored by Remote Desktop. I know which stored credential was incorrect, but it was stored for Remote Desktop access to a specific machine and was not being used (at least not by me) at the time of the warnings. The Security-Kerberos warning appears when the system was starting up (after a Windows Update reboot) and also appeared earlier this morning when nobody was logged into the machine.

Clarification after SnOrfus answer:

There was 1 set of invalid credentials that was stored for a terminal server. The rest of the credentials are known to be valid (used often & recently without issues). I logged on to the domain this morning without issue. I then ran windows update which rebooted the computer. After the restart, I couldn't log in (due to account being locked out). After unlocking & logging on to the domain, I checked Event Viewer which showed a problem with credentials after restarting.

Since the only stored credentials (according to Credential Manager) are for terminal servers, why would there be a Credential problem on restart when remote desktop was not being used?

Question

Does anyone know if Windows 7 "randomly" checks the authentication of cached credentials?

© Super User or respective owner

Related posts about windows-7

Related posts about user-accounts