Does Windows 7 Authenticate Cached Credentials on Startup
        Posted  
        
            by 
                Farray
            
        on Super User
        
        See other posts from Super User
        
            or by Farray
        
        
        
        Published on 2011-04-15T16:29:04Z
        Indexed on 
            2011/11/29
            1:54 UTC
        
        
        Read the original article
        Hit count: 490
        
Problem
I have a Windows domain user account that gets automatically locked-out semi-regularly.
Troubleshooting Thus Far
The only rule on the domain that should automatically lock an account is too many failed login attempts.
I do not think anyone nefarious is trying to access my account.  The problem started occurring after changing my password so I think it's a stored credential problem.  Further to that, in the Event Viewer's System log I found Warnings from Security-Kerberos that says:
The password stored in Credential Manager is invalid. This might be caused by the user changing the password from this computer or a different computer. To resolve this error, open Credential Manager in Control Panel, and reenter the password for the credential mydomain\myuser.
I checked the Credential Manager and all it has are a few TERMSRV/servername credentials stored by Remote Desktop.  I know which stored credential was incorrect, but it was stored for Remote Desktop access to a specific machine and was not being used (at least not by me) at the time of the warnings.  The Security-Kerberos warning appears when the system was starting up (after a Windows Update reboot) and also appeared earlier this morning when nobody was logged into the machine.
Clarification after SnOrfus answer:
There was 1 set of invalid credentials that was stored for a terminal server. The rest of the credentials are known to be valid (used often & recently without issues). I logged on to the domain this morning without issue. I then ran windows update which rebooted the computer. After the restart, I couldn't log in (due to account being locked out). After unlocking & logging on to the domain, I checked Event Viewer which showed a problem with credentials after restarting.
Since the only stored credentials (according to Credential Manager) are for terminal servers, why would there be a Credential problem on restart when remote desktop was not being used?
Question
Does anyone know if Windows 7 "randomly" checks the authentication of cached credentials?
© Super User or respective owner