How to DELETE Windows Local & Domain Cached Passwords

I believe almost every Windows Administrator must have got stumped with this question “Where does WINDOWS store a users cached credentials?”

To delete locally cached credentials you could type the following command in the ‘Run’ prompt:

CONTROLUSERPASSWORDS2 or rundll32.exe keymgr.dll,KRShowKeyMgr

Not many of us would have come across the interfaces which get launched after executing the above mentioned commands. Browse to Advanced>Manage Passwords, and you’ll see all the credentials which are locally cached. You could Add/Delete them, bear in mind that you need to run this command as an Administrator.

Now, coming to an interesting part which I recently came across; where do we look out for user credentials cached at the domain level??

If you launch Windows registry with SYSTEM level privilege and browse to “HKEY_LOCAL_MACHINESECURITYCACHE”, you will find a total of 10 entries starting from NL$1 to NL$10. These binary entries contain users cached credentials at the domain level.

By default Windows allows a total of 10 credentials to be cached and if all 10 entries are full, any new credential to be cached will be overwritten by the Value Date in the oldest NL$ entry.
Also, to know how many free entries are left, simply count the number of entries whose binary value data is full of ’0′.

For those who wish to know how to gracefully clear the domain cached credentials, this cannot be achieved by deleting these entries.

If you delete the NL$ entries, Windows will never cache any users credentials in the future.
Simply edit the “Value Data” in each NL$ entry and replace the data with ’0′ (ZERO). This will clear all the existing cached credentials.

A key thing to note over here is:

Windows Registry with SYSTEM level privilege cannot be launched by simply executing REGEDIT.EXE from the RUN prompt. You will need to launch it as follows:

at xx:xx /interactive “regedit.exe”

Where XX:XX is the time in the FUTURE when you would want to launch the registry. Suppose if the system time on your Server/Desktop shows 23:50 then you could type
at 23:51 /interactive “regedit.exe

This would launch the registry with SYSTEM level privilege when your server/desktop clocks 23:51.

Again, you will succeed to launch this only if you are logged onto the system as an Administrator.

This works with Windows XP/2000/2003 and may also work with 2008 but I have not tried it there.