Computer doesn't connect to the LAN network and doesn't cache credentials either

Question

Computer doesn't connect to the LAN network and doesn't cache credentials either

IRosales 0

We are testing policies recommended by CIS and MS on a laptop which now cannot access the network. When logging in, it says "We can't sign you in with this credential because your domain isn't available..." even though the user was logged in before. Cached credentials was set to 10, then changed to 0 but still no go. It seems that there is no network connectivity upon reboot but the cached credentials also do not work.

2 answers

Your answer

Answer 1

Daniel Alejandro Rivera Dominguez 415 Microsoft External Staff

Hello, Thank you for using the Microsoft Q&A forums. Have you tried creating an Administrator account locally for this? It may help with privileges since you are not using those in the network.

IRosales 0 Reputation points

2024-01-24T22:07:26.0433333+00:00

Local admin account uses LAPS and the password does not work. We cannot log in in any way now so we can't add another local admin account. We will re-image the laptop and start again.
Any ideas on what policies might have affected the network connection as well as cached credentials?
Daniel Alejandro Rivera Dominguez 415 Reputation points Microsoft External Staff

2024-01-25T09:14:09.54+00:00

I honestly wouldn't know where to begin. Not just policies that directly affect cached credentials, many policies could be affecting the network indirectly, or possibly affecting things required for connectivity. For example, one policy requires a certain protocol from clients and another policy blocking all other protocols from the client, and then the client not having the one required protocol enabled. It may even be unrelated to policies, and more about having the Domain configured. Maybe the laptop cannot reach the DC to authenticate, for example. I would check if any policy is blocking of limiting connection in any way and see it it requires changing ports or adding a firewall rule.
Daniel Alejandro Rivera Dominguez 415 Reputation points Microsoft External Staff

2024-01-25T10:07:56.7566667+00:00

Looked more into it, there is one policy that may be the issue:
"Network access: Do not allow storage of passwords and credentials for network authentication". This would force the "cachedlogonscount" reg key to 0, which in turn would prevent accessing the network if the machine is not already communicating with the Domain Controller. This is not recommended for laptops. I'll leave the link below.

https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication
IRosales 0 Reputation points

2024-01-29T02:13:34.51+00:00

We are now able to log in when we completely left the policy Interactive logon: Number of previous logons to cache (in case domain controller is not available) as not configured. Not sure why not even setting it to 10 or 0 or whatever number did not work.
Daniel Alejandro Rivera Dominguez 415 Reputation points Microsoft External Staff

2024-01-29T10:11:04.59+00:00

My only guess at this point is that this policy forces the use of cached credentials, meaning that if no cached credentials exist then it fails. https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available

In any case, hopefully now that you regained the log in, you can slowly apply the policies you wish while testing which causes undesired results. For laptops, the best practice is to never have anything cached and require the input of credentials every time.

Answer 2

Hello, Using cached credential to log on to domain windows system when the DC is inaccessible, please make sure that credential is cached and stored in below location: HKEY_LOCAL_MACHINE\Security\Cache (%systemroot%\System32\config\SECURITY). You may reference below link for more information: https://woshub.com/cached-domain-logon-credentials-windows/ https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/cached-domain-logon-information

---If the Answer is helpful, please click "Accept Answer" and upvote it.

Share via

Computer doesn't connect to the LAN network and doesn't cache credentials either

2 answers

Your answer