Disable Domain Credential Caching with Regedit

This article explains how to disable domain credential caching on mobile Windows laptops using the Registry Editor (Regedit). By default, Windows caches previous logon credentials locally so users can sign in when disconnected from the corporate network. Disabling this setting forces the machine to contact an Active Directory Domain Controller for every authentication attempt, which enhances security on sensitive portable devices.

Step-by-Step Guide to Disabling Cached Logons

To disable domain credential caching via the Windows Registry, follow these steps:

  1. Open Registry Editor
    Press Windows Key + R, type regedit into the Run dialog box, and press Enter. If prompted by User Account Control (UAC), click Yes to grant administrative privileges.

  2. Navigate to the Winlogon Key
    In the Registry Editor address bar, paste or navigate to the following path:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

  3. Locate the CachedLogonsCount Value
    In the right-hand pane, scroll down to find the string value named CachedLogonsCount.
    (Note: If this value does not exist, right-click the empty space in the right pane, select New > String Value, and name it CachedLogonsCount.)

  4. Change the Value to Zero
    Double-click CachedLogonsCount to edit it. In the Value data field, change the number to 0 and click OK.

  5. Restart the Computer
    Close the Registry Editor and reboot the laptop for the changes to take effect.

Important Considerations

Setting CachedLogonsCount to 0 completely disables offline authentication. If the laptop is disconnected from the local area network, Wi-Fi, or an always-on corporate VPN, domain users will receive an error stating that no logon servers are available and will be unable to log in until network connectivity to a Domain Controller is restored.