Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallDomain credential caching is Windows’ offline sign-in fallback for domain-joined computers. After a user has successfully logged on while connected to Active Directory, Windows keeps a protected verifier for a limited number of previous interactive logons. If no domain controller is reachable later, Windows can compare the entered password with that verifier and open the local desktop.
This gets the user onto the computer; it does not make the computer online to the domain. File shares, new domain authentication, current group membership, account disablement, and other services may still require a live domain connection.
As an Amazon Associate I earn from qualifying purchases.
What domain credential caching means
Normally, a domain-joined Windows device sends an interactive logon request to a domain controller. Cached domain logon information—also called cached logons or cached domain credentials—exists for laptops, travel, branch offices, WAN outages and other situations where that controller cannot be reached.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Microsoft describes the stored material as a local password verifier, not a plaintext password. Windows uses it only to validate a local offline interactive logon; it is not a reusable credential that can normally be presented to another computer. See Microsoft’s explanation of the mechanism at Credential Guard: how it works and the cached-logon documentation at Cached domain logon information.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How an offline logon works
- The user enters a domain account name and password at the Windows sign-in screen.
- Windows tries to locate and contact a domain controller.
- If domain validation is unavailable, Windows checks whether that account has a previous cached logon.
- Windows computes a verifier from the entered password and compares it with the protected local value.
- If they match, Windows creates a local logon session and loads the user profile.
Depending on Windows version, language, credential provider and policy, the sign-in screen may report that a domain controller could not be contacted and that cached account information was used. The user can work with local files and applications, but the device remains disconnected from live domain services.
What is cached—and what is not
| Item | Purpose | General network credential? |
|---|---|---|
| Cached domain-logon verifier | Validates a previous domain password locally when no controller is reachable | No |
| Credential Manager entry | Stores credentials for particular applications, shares or services | Sometimes, depending on the credential |
| Kerberos ticket | Time-limited authentication to domain services | Only while valid and usable |
| NTDS.dit | Active Directory’s domain-controller database | Not stored on an ordinary client |
| Microsoft Entra token | Authentication to cloud resources | Depends on the token, device and policy |
Modern Windows uses the DCC2/MS-Cache v2 family of verifiers. They are distinct from a normal NTLM hash and from saved passwords in Windows Credential Manager. MITRE tracks theft of this material as OS Credential Dumping: Cached Domain Credentials (T1003.005).
What works offline
Usually available
- Signing in to the local Windows desktop for a user with a valid cached logon.
- Local files and locally installed applications.
- Work that does not require Active Directory or another network identity provider.
Usually unavailable or unreliable
- File shares requiring current domain authentication.
- New domain logons, Kerberos tickets, VPN authentication or MFA.
- Unreceived group-membership and policy changes.
- Immediate enforcement of account disablement, expiration or lockout.
- A password change that has not been successfully validated online.
The practical rule is simple: cached logon provides local computer access, not online domain access.
How many logons Windows caches
The security policy limits previous interactive domain logon information stored on the device. Microsoft documents values from 0 through 50; values above 50 are treated as 50. A value of 0 disables cached fallback. Microsoft documents 10 as the default for most Windows versions, with historical edition exceptions.
This is a bounded cache, not “10 attempts for one user.” Previous logons by multiple users can consume entries, and lowering the limit can displace older users. Changing the value does not create an offline logon for someone who has never successfully logged on while connected to a domain controller.
Rank #2
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Configure the cached-logon count
Group Policy (preferred for managed devices)
- Open the applicable local or domain Group Policy editor.
- Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.
- Open Interactive logon: Number of previous logons to cache (in case domain controller is not available).
- Enter a value from 0 to 50 and apply the policy.
- Restart the computer; Microsoft requires a restart for the change to take effect.
The wording can vary slightly by Windows release. This is a computer-wide setting, not a normal per-user control.
Registry method for testing or scripting
Administrative rights are required. Group Policy can overwrite a local edit, so use policy for enterprise deployment.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" ^
/v CachedLogonsCount
reg add "HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" ^
/v CachedLogonsCount /t REG_SZ /d 10 /f
reg add "HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" ^
/v CachedLogonsCount /t REG_SZ /d 0 /fThe documented value is CachedLogonsCount, type REG_SZ, under HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon. Back up and test security-policy changes before broad rollout, then restart.
Should you set the value to zero?
| Environment | Reasonable direction | Main trade-off |
|---|---|---|
| Mobile workforce with occasional offline work | Keep a modest count; combine with disk encryption, endpoint management and Credential Guard where compatible | Offline access can persist after a password change or termination until reconnection |
| Fixed desktops with reliable controller access | Reduce the count or use 0 | Network or domain-controller outages can block local sign-in |
| Remote users needing domain logon before VPN | Use pre-logon VPN, device tunnel or certificate-based machine authentication | More VPN, certificate and deployment complexity |
| High-security endpoints | Minimize or eliminate caching and prohibit privileged interactive logons | Greater dependence on network availability and recovery procedures |
Setting 0 is not universally “more secure.” A remote user whose VPN starts only after Windows logon may be locked out completely. Plan a pre-logon path, approved local recovery account, physical support process or another credential provider before disabling fallback. MITRE lists limiting cached credentials as part of credential-access mitigation.
Password changes, stale logons and terminated users
Password changes
After a password change, the local verifier may not be replaced until the device completes a successful online authentication. A user traveling offline may therefore find that the old password works locally while the new one does not. Cloud password changes and on-premises verification can also be temporarily out of sync.
Rank #3
- ✅ PROTECT ONLINE ACCOUNTS – A password manager, two-factor security key, and secure communication token in one, OnlyKey can keep your accounts safe even if your computer or a website is compromised. OnlyKey is open source, verified, and trustworthy.
- ✅ UNIVERSALLY SUPPORTED – Works with all websites including Twitter, Facebook, GitHub, and Google. Onlykey supports multiple methods of two-factor authentication including FIDO2 / U2F, Yubico OTP, TOTP, Challenge-response.
- ✅ PORTABLE PROTECTION – Extremely durable, waterproof, and tamper resistant design allows you to take your OnlyKey with you everywhere.
- ✅ PIN PROTECTION – Locking your device means that if this device is stolen, data remains secure, after 10 failed attempts to unlock all data is securely erased.
- ✅ EASY LOG IN – No need to remember multiple passwords because by plugging OnlyKey to your computer, it automatically inputs your username and password. It works with Windows, Mac OS, Linux, or Chromebook, just press a button to login securely!
- Connect directly or through a correctly configured VPN that has line of sight to a domain controller.
- Sign in, or lock and unlock, with the new password.
- Confirm domain connectivity and current policy.
- Only then test offline behavior if the organization relies on it.
If sign-in is impossible, use a pre-logon VPN, an approved local recovery account or IT support. Starting a VPN after sign-in does not repair a pre-logon failure by itself.
Disabled, expired or terminated accounts
When a device is offline, it cannot immediately learn that an account was disabled, expired or locked out. A user with valid cached information may still reach the local desktop, although current domain resources should fail. Termination procedures therefore need device isolation or remote management, session and token revocation, disk protection and eventual reconnection—not only an Active Directory disable action.
First logon and multiple users
A first-ever domain sign-in generally cannot occur completely offline because no verifier exists yet. Multiple previous interactive users can occupy the cache, so reducing the count may remove older users’ offline access.
Security implications
An attacker with high local privilege or offline access to a device may try to extract and crack cached verifier material. Risk increases when laptops are stolen, disks are unencrypted, local administrator rights are widespread, domain passwords are reused, privileged accounts log on interactively to ordinary workstations, devices stay disconnected for long periods or passwords are weak.
- Use full-disk encryption with protected recovery keys.
- Remove unnecessary local administrator rights.
- Prohibit domain-admin and other privileged interactive logons on standard workstations.
- Enable Credential Guard where the edition, hardware and applications support it.
- Use strong passwords, MFA and reliable device management.
- Monitor for credential-dumping behavior and maintain an offline termination procedure.
Caching does not mean plaintext passwords are sitting in the registry, that every local user can read them, or that the verifier automatically enables lateral movement. It is still valuable credential material: MITRE documents the attack technique specifically.
Recommended Free Tools
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Cached logons and Credential Guard are different
Cached domain logon answers, “Can this user open this computer without a controller?” Credential Guard isolates selected credential secrets using Virtual Secure Mode to make theft harder. It does not turn cached logons into online authentication, remove every cached-logon risk or protect every Windows Vault secret.
Compatibility varies by Windows edition, release, hardware, policy and join state. Microsoft documents issues affecting password-based VPN or RDP single sign-on, third-party security providers, 802.1X and other legacy workflows; test those paths before deployment using Credential Guard known issues. Current support information covers Windows 10, Windows 11 and Windows Server 2016, 2019, 2022 and 2025, but availability and default enablement are not identical across releases.
Troubleshoot “the domain isn’t available”
- Verify the device is on the intended network and that DNS uses domain-aware DNS servers.
- Check whether a domain controller can be located and whether a VPN is required before logon.
- Confirm the user has successfully logged on online at least once.
- Check whether
CachedLogonsCountis 0 or whether other users displaced the entry. - Consider stale-password state, a broken machine trust relationship, Credential Guard and third-party credential providers.
- Use the expected domain-qualified username and test again after restoring controller connectivity.
gpresult /h "%TEMP%gpresult.html"
reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" ^
/v CachedLogonsCount
systeminfo | findstr /I "Domain"These checks are non-destructive. Do not delete security-hive data or make undocumented registry edits as a first response.
Alternatives to relying on cached logons
Pre-logon or Always On VPN
A pre-logon VPN or device tunnel gives the computer a route to DNS and domain controllers before interactive sign-in. Microsoft’s Always On VPN overview and Intune VPN guidance cover device and user tunnels, certificates and AD- or Entra-joined scenarios. This is a strong fit for organizations retaining on-premises AD, but it requires operating gateways, PKI, authentication and support.
Entra join and Windows Hello for Business
Entra-joined devices and device-bound Windows Hello for Business credentials can reduce dependence on reusable AD passwords. They do not automatically replace legacy SMB, Kerberos, certificates or line-of-business applications; validate each dependency separately.
Identity-centric ZTNA
Microsoft Entra Private Access and Global Secure Access provide identity- and policy-based access to private applications without requiring a traditional full-tunnel VPN. See Microsoft’s Global Secure Access overview. ZTNA addresses application access after device authentication; it is not a replacement for offline local Windows sign-in.
Deployment test plan
- Record the Windows edition, build, join type and applied policy.
- Test first logon, repeat offline logon, lock/unlock and each approved credential provider.
- Change a test password online, then verify new-password synchronization before disconnecting.
- Test controller outage, DNS failure, VPN-before-logon and VPN-after-logon scenarios.
- Disable a test account and confirm the documented offline termination response.
- Test file shares, RDP, VPN, 802.1X, smart cards and line-of-business applications with Credential Guard enabled if planned.
- Document recovery contacts, local recovery credentials, device isolation and disk-encryption key procedures.
The Bottom Line
Keep cached domain logons only when their offline availability is intentional. Set the count from a documented availability and threat model, deploy it through Group Policy, protect devices with encryption and least privilege, and provide pre-logon connectivity or a recovery path before reducing the count to zero.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute
