Home / server / Questions / 699801
In Process
MathewC
Asked: 2015-06-18 13:39:18 +0800 CST

How can I tell which users credentials are cached on a local system?

  • 772

I'm troubleshooting cached credentials on Windows 7, specifically Smart Card logins, and I would like to know how I can find out which users currently have their credentials cached on the machine.

I have read How are cached Windows credentials stored on the local machine?

and can see the HKLM/Security/cache registry keys, but they are just hash values.

windows

1 Answers

  1. I'm not sure that there is an officially supported technique or API for this.

    One method of getting this info (be ready to trigger the antivirus software on your computer) would be to use Mimikatz.

    mimikatz # lsadump::cache

    • 1