How to determined if computer is using cached credentials ?

Forums › IT Pro and developers › How to determined if computer is using cached credentials ?

fran1942

82 posts

Master Geek

Trusted

#171527 21-Apr-2015 17:35

Hello, is there an easy way to tell if a computer is currently connected to a domain or is logged in under cached credentials ?
If I look at 'System;, it just says what domain the computer is part of but does not say if it currently network connected or just using cached credentials.

Thanks kindly.

Dynamic

3866 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#1288701 21-Apr-2015 17:39

I expect the Event Log will tell you this. Perhaps power on the computer with the network cable unplugged and have a look at the Event Log when you login.

“Don't believe anything you read on the net. Except this. Well, including this, I suppose.” Douglas Adams

Referral links to services I use, really like, and may be rewarded if you sign up:
PocketSmith for budgeting and personal finance management. A great Kiwi company.

jhsol

102 posts

Master Geek

#1304864 13-May-2015 23:04

change the users password on AD. Get user to log in with new credentials. If it works its connected to the domain to authenticate. If it fails, but allows you to log in with old credentials, its not connected to the domain (at authentication time anyway)

tardtasticx

3075 posts

Uber Geek

#1304873 14-May-2015 00:20

Event Log should show it (Login Type 11 is for cached logins from what I can find http://windowsitpro.com/systems-management/q-what-are-different-windows-logon-types-can-show-windows-event-log)
Try to ping the Domain Controller (If ping works then it should have connected just fine, if not then most likely not connected and cached?)
Disable the account and ask them to login (similar to above post, but without the annoyance of the user having to create a new password, obviously if they can login it's cached)

kontonnz

137 posts

Master Geek

#1304875 14-May-2015 02:30

echo %logonserver%

or

nltest /dsgetdc:your_domain_name_goes_here