programatically/automatically delete all saved passwords for IE for any user

Question

Due to some compliance requirements, I am now required to disable the "save usernames & passwords" option for IE on all my systems. That part I have figured out via creating a GPO.

However, part of the compliance also states that I must remove any existing passwords that have previously been saved. The GPO does not have that capability. Any passwords that a user has already saved will still be available to use, they just won't be able to save new ones.

I'm trying to find exactly where these usernames and/or passwords are saved so that I can write a script to permanently delete them. I've found conflicting information (or maybe just different information for different browser versions, but that's not really clarified in the articles I've found).

Some may be saved in the registry, some may be saved via vaultcli.dll , or perhaps somewhere in the users' %AppData% profile. In doing some testing with my own account, I have not been able to definitively locate exactly WHERE these credentials are written. I need to avoid relying on users to delete their own stuff (because we all know how that will end :) )

Any thoughts / references / links would be greatly appreciated. Thanks.

Answer 1

Hi

The password are saved in the credential manager.

This one liner work to remove ALL cached password.

for /F "tokens=1,2 delims= " %G in ('cmdkey /list ^| findstr Target') do cmdkey /delete %H

You could script it a bit more to target only website, please see that post for detail; https://superuser.com/questions/689456/what-is-the-windows-7-command-line-to-remove-all-remember-passwords-in-credentia

To test without script, just use cmdkey /list, you will see the output.

Answer 2

Thank you for the suggestion: I tested this solution but it did not solve the issue:

1) using IE, log in to a website and answer "Yes" when prompted to save the password
2) log out and back in using the saved credential
3) run the above command to delete any existing saved credentials
--ran the command with /list to verify that None was returned (no credentials saved)
4) using IE, browse to website from step 1 -- credentials are still saved and I'm able to log in
-- the credentials are still present in the Credential manager even after a refresh

so the command did not delete my existing credentials.

Any other suggestions?