Does Windows 7 Authenticate Cached Credentials on Startup
Posted
by
Farray
on Super User
See other posts from Super User
or by Farray
Published on 2011-04-15T16:29:04Z
Indexed on
2011/11/29
1:54 UTC
Read the original article
Hit count: 406
Problem
I have a Windows domain user account that gets automatically locked-out semi-regularly.
Troubleshooting Thus Far
The only rule on the domain that should automatically lock an account is too many failed login attempts.
I do not think anyone nefarious is trying to access my account. The problem started occurring after changing my password so I think it's a stored credential problem. Further to that, in the Event Viewer's System log I found Warnings from Security-Kerberos
that says:
The password stored in Credential Manager is invalid. This might be caused by the user changing the password from this computer or a different computer. To resolve this error, open Credential Manager in Control Panel, and reenter the password for the credential mydomain\myuser.
I checked the Credential Manager and all it has are a few TERMSRV/servername
credentials stored by Remote Desktop. I know which stored credential was incorrect, but it was stored for Remote Desktop access to a specific machine and was not being used (at least not by me) at the time of the warnings. The Security-Kerberos
warning appears when the system was starting up (after a Windows Update reboot) and also appeared earlier this morning when nobody was logged into the machine.
Clarification after SnOrfus answer:
There was 1 set of invalid credentials that was stored for a terminal server. The rest of the credentials are known to be valid (used often & recently without issues). I logged on to the domain this morning without issue. I then ran windows update which rebooted the computer. After the restart, I couldn't log in (due to account being locked out). After unlocking & logging on to the domain, I checked Event Viewer which showed a problem with credentials after restarting.
Since the only stored credentials (according to Credential Manager) are for terminal servers, why would there be a Credential problem on restart when remote desktop was not being used?
Question
Does anyone know if Windows 7 "randomly" checks the authentication of cached credentials?
© Super User or respective owner